Issues with colons in messages to the child frame

[xss]

This might be a regression of an issue fixed in v2.4.8.

In order to receive messages from the parent window (via iframe.iFrameResizer.sendMessage()), I defined the following within the child iframe before loading the iframeresizer.contentwindow.js:

<script>
window.iFrameResizer = {
    messageCallback: function (messageData) {
        // Do something with messageData which is the plain text sent from the parent
        // via iframe.iFrameResizer.sendMessage().
        // ATTENTION: Contrary to messageCallback() on the parent side, the message 
        // text resides directly in messageData here, *not* in messageData.message!
    },
};
</script>
<script src="js/iframeresizer.contentwindow.js"></script>

Aside from the issue with the differences between messageCallback() in the parent frame and the child frame, I cannot send messages containing a colon (:) character to the child iframe. For some reason, the message seems to automatically be parsed with JSON.parse() by the child iframe, but whatever string it gets passed for parsing, the colon always results in an error:

[iFrameSizer][Host page][Send Message] Sending msg to iframe[resizable] (message:"hello: you!")
[iFrameSizer][resizable] MessageCallback called from parent: "hello
SyntaxError: JSON.parse: unterminated string at line 1 column 7 of the JSON data

Usage of single-quotes or double-quotes doesn't seem to make a difference here.

I stumbled upon this as I was trying to send JSON formatted messages to the child, the same way I can send it from the child iframe to the parent window. By now I resorted to sending some kind of "pseudo-JSON" message from the child (iframe.iFrameResizer.sendMessage('{"message" => "parent says hello."}'); which I convert to real JSON within the child (messageData = messageData.replace(/\ ?\=\>/g, ':');) before I JSON.parse(messageData) it manually and use it (e.g. console.log( msgCallback['message'] );).

This whole thing seems really counter-intuitive to me, both the differences between the parent's and the contentWindow's (child's) messageCallback(), and the fact that, as is, I can use JSON only in one direction and a : would break any message from parent to the child.

Did I just implement the child iframe's messageCallback() wrong? I find the documentation on this really, really scarce and sketchy. I wouldn't be surprised if I just didn't use it correctly.

[davidjbradshaw]

Yep agree the colon thing is a bug. It's due to the way the message is broken up, as colon is the separator. I will try and find sometime next week to fix it. Or if you want to have a go and submit a PR, take a look at line 856 in child script and the function getMsgBody in the host page script.

As for the difference between the two messageCallback functions, on the parent page it has to also pass details of the iFrame the message came from, as you might have more than one on your page, where as in the child this is not an issue.

[davidjbradshaw]

Fix is in the dev branch and will be released in v3.1.1

[xss]

Hello David,

wow, you've been busy over the weekend! Thank you very much, the colon thingy works like a charm now, as far as I could test. 👍