Make installLocationIframe.js in GWT compatible with CSP. This change removes "javascript:" assignment to src attribute of a newly created an iframe. This is effectively a no-op but creates a CSP violation. Manually tested on IE8, 9, 10, 11 and Edge, and current Firefox and Chrome. Change-Id: I4d5a1e66efadabba102703e7ce90c01b06a9c45b Review-Link: https://gwt-review.googlesource.com/#/c/18480/
diff --git a/dev/core/src/com/google/gwt/core/ext/linker/impl/installLocationIframe.js b/dev/core/src/com/google/gwt/core/ext/linker/impl/installLocationIframe.js index fa9abad..59fca5c 100644 --- a/dev/core/src/com/google/gwt/core/ext/linker/impl/installLocationIframe.js +++ b/dev/core/src/com/google/gwt/core/ext/linker/impl/installLocationIframe.js
@@ -31,22 +31,21 @@ // Create the script frame, making sure it's invisible, but not // "display:none", which keeps some browsers from running code in it. var scriptFrame = $doc.createElement('iframe'); - scriptFrame.src = 'javascript:""'; scriptFrame.id = '__MODULE_NAME__'; scriptFrame.style.cssText = 'position:absolute; width:0; height:0; border:none; left: -1000px;' + ' top: -1000px;'; scriptFrame.tabIndex = -1; $doc.body.appendChild(scriptFrame); - frameDoc = scriptFrame.contentDocument; - if (!frameDoc) { - frameDoc = scriptFrame.contentWindow.document; - } + frameDoc = scriptFrame.contentWindow.document; - // The missing content has been seen on Safari 3 and firebug will - // behave incorrectly on soft refresh unless we explicitly set the content - // of the frame. However, we don't want to do this when runAsync calls - // installCode, so we do it here when we create the iframe. + // The following code is needed for proper operation in Firefox, Safari, and + // Internet Explorer. + // + // In Firefox, this prevents the frame from re-loading asynchronously and + // throwing away the current document. + // + // In IE, it ensures that the <body> element is immediately available. frameDoc.open(); var doctype = (document.compatMode == 'CSS1Compat') ? '<!doctype html>' : ''; frameDoc.write(doctype + '<html><head></head><body></body></html>');