Webkit的跨域安全问题说明_javascript技巧

代码如下:

代码如下:

据了解，采用此类try catch方式做安全可行性判断的并不只是个别现象，如DOJO

代码如下:

try{
//see if we can access the iframe's location
//without a permission denied error
var iframeSearch = _getSegment(iframeLoc.href, "?");
//good, the iframe is same origin (no thrown exception)
if(document.title != docTitle){
//sync title of main window with title of iframe.
docTitle = this.iframe.document.title = document.title;
}
}catch(e){
//permission denied - server cannot be reached.
ifrOffline = true;
console.error("dojo.hash: Error adding history
entry. Server unreachable.");
}

代码如下:

try{
if ( (/fcksource=true/i).test( window.top.location.search ) )
sFile = 'fckeditor.original.html' ;
}
catch (e) { /* Ignore it. Much probably we are insi
de a FRAME where the "top" is in another domain (security error). */ }

还有很多网友的反馈：chrome bug report

以上代码在chrome,safari,opera均不适用。翻了一些资料，记录在此：
1.html5 security location
2.webkit dev lists
从webkit开发人员的讨论消息中看到，他们承认这个问题但并不情愿去改正，holly shit！