您能否关闭 IE7 中的 XSS 保护，以便 Intranet 应用程序可以知道异地 IFRAME 的内容？
TL;DR： 我可以在受控环境中关闭 Internet Explorer 中的 XSS 保护，以便可以操作 IFRAMES 内的 DOM 吗？
我正在接待区为公共计算机创建一个信息亭，让我们的用户可以浏览我们的网站以及其他一些地方政府相关网站（有助于规划、建筑许可证等的网站）。
信息亭“应用程序”本身由顶部的菜单和底部的 iframe 组成 - 其目的是菜单始终存在并允许用户选择另一个站点、注销、打印等。因此，为什么他们的站点正在浏览的内容将出现在 iframe 中。
其中一些网站（包括我们的*）使 pdf 文件和外部链接在新的浏览器窗口中弹出。显然这会打破“信息亭”的体验。 我想知道的是；有没有一种方法可以绕过阻止您修改 IFRAME DOM 的 XSS 保护 - 这样我就可以强制这些窗口在当前 IFRAME 中打开？
请理解，我不想“阻止”弹出窗口，只是对浏览会话的行为有更大程度的控制。
另请注意：此应用程序设计为在我们完全控制的已知环境中运行（即它不必在野外工作）。因此，任何需要插件、注册表黑客或第三方应用程序的建议都是可以的:)
*是的，我知道，我知道，当我在今年晚些时候进行重新设计时，我将修复整个弹出窗口的问题
TL;DR: Can I switch off XSS protection in Internet Explorer in a controlled environment so I can manipulate the DOM inside IFRAMES?
I am creating a kiosk for our public computers in our reception area which allows our users to browse our website as well as a few other local government related sites (ones that help with planning, building licences etc).
The kiosk "application" itself consists of a menu at the top and an iframe at the bottom - the intent is that the menu is always there and allows users to select another site, log off, print, etc. Hence why the sites that they are browsing will appear in an iframe.
Some of these websites (our's included*), make pdf files and external links pop open in a new browser window. Obviously this will break the "kiosk" experience. What I want to know is; is there a way that I can bypass the XSS protection that prevents you from modifying the DOM of an IFRAME - so that I can force these windows to open in the current IFRAME instead?
Please understand that I don't want to "block" the popups, just have a greater degree of control as to the behaviour of the browsing session.
Also note: this application is designed to run in a known environment that we have complete control over (i.e. it's not like it has to work in the wild). So any suggestions that require plugins, registry hacks or third party applications are A-OKAY :)
*yes, I know, I know, I will fix the whole popup thing when I get to do a redesign later in the year
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
只是为了结束这个问题并让其他人了解如何解决这个问题。我决定将我的信息亭编写为 HTML 应用程序 (HTA)。这使您可以深入了解任何 IFRAMES，查看其中的内容，根据需要进行更改，了解某些元素何时获得焦点等。如果有人觉得这很有用，请参阅以下链接。
http://msdn.microsoft.com/en-我们/库/ms536496%28VS.85%29.aspx
Just to close off this question and to allow others to find out about how you can solve this problem. I decided to write my kiosk as an HTML Application (HTA). This allows you to drill down into any IFRAMES, see what's in there, make changes if required, know when certain elements are focussed etc. Here is the link in case anyone finds this useful.
http://msdn.microsoft.com/en-us/library/ms536496%28VS.85%29.aspx
如果您使用 IE，您可以尝试禁用一些安全选项。
打开IE>安全>自定义级别
有标记为“启用 XSS 过滤器”和“跨不同域导航窗口和框架”的选项。尝试和他们一起玩。
If you are using IE, there are a few security options you can try to disable.
Open IE > Security > Custom Level
There are options labeled "Enable XSS Filter" and "Navigate windows and frames across different domains". Try and play with them.