Possible Duplicate:
Should Stack Exchange be using the X-FRAME-OPTIONS header?
Yesterday I was hanging out in the PHP chatroom feeling a little bored, and then saw the leave button and remembered that it didn't ask for confirmation, so I tried putting that URL (https://chat.stackoverflow.com/chats/leave/11) into an image src, as I remember was done with the logout URL a while ago by someone else.
It didn't work, as it presented an 'are you sure' page.
Then the Twitter "Don't Click" prank came to mind.
I put the Stack Overflow 'leave all' page in an iframe, expecting it to display the standard For security reasons, framing is not allowed; click OK to remove the frames. message to appear.
Surprisingly, it didn't.
So, I positioned the frame inside a <div> set to overflow: hidden, and made it invisible.
I put a simple WebKit notification test in as a guise, with a button underneath labeled notify.
Then I added the onload attribute to the iframe that would execute a JavaScript function.
The JavaScript function would detect if it had loaded for the first time or not.
If it had loaded for a second time, the script assumes that the leave button has been clicked, and acts as if the button behind it had been (i.e. it displays the test notification).
I tested it, and sure enough, the chat tab went to the 'all rooms' page. I had left the room.
I then posted a message in chat to test it.
Nick was the first to fall for it (sorry Nick).
Levi was the first to notice, but still didn't fully realize what was happening.
I was not online by then, and no-one else took any notice of it after that.
This morning I improved it more, and managed to bust the frame-buster-buster-buster.
I had created the frame-buster-buster-buster-buster!
My addition was the a button that logs the user out.
How I did it:
Normally, if you put Stack Overflow in a frame, it will be busted.
I therefore applied a sandbox to the iframe.
I managed to get it to not bust the frames, but is would still display the alert.
I then discovered that I could put sandbox="allow-forms" and it would block scripts, but allow the submission of forms.
