Evan Portwood evanportwood

Security-Reviewing Uses of `postMessage()`

The postMessage() API is an HTML5 extension that permits string message-passing between frames that don't share the same origin. It is available in all modern browsers. It is not supported in IE6 and IE7.

postMessage is generally considered very secure as long as the programmer is careful to check the origin and source of an arriving

Title

<Additional information about your API call. Try to use verbs that match both request type (fetching vs modifying) and plurality (one vs multiple).>

URL

<The URL Structure (path only, no root url)>
Method:

Git

Global Settings

Related Setup: https://gist.github.com/hofmannsven/6814278
Related Pro Tips: https://ochronus.com/git-tips-from-the-trenches/
Interactive Beginners Tutorial: http://try.github.io/
Git Cheatsheet by GitHub: https://services.github.com/on-demand/downloads/github-git-cheat-sheet/

Reminder

Press minus + shift + s and return to chop/fold long lines!

	/*!
	* backbone.collectioncache.js v0.0.2
	* Copyright 2012, Tim Branyen (@tbranyen)
	* backbone.collectioncache.js may be freely distributed under the MIT license.
	*/
	(function(window) {

	"use strict";

	// Dependencies

	(function (window) {
	// This library re-implements setTimeout, setInterval, clearTimeout, clearInterval for iOS6.
	// iOS6 suffers from a bug that kills timers that are created while a page is scrolling.
	// This library fixes that problem by recreating timers after scrolling finishes (with interval correction).
	// This code is free to use by anyone (MIT, blabla).
	// Original Author: rkorving@wizcorp.jp
	var timeouts = {};
	var intervals = {};
	var orgSetTimeout = window.setTimeout;
	var orgSetInterval = window.setInterval;

	void function() {//closure

	var global = this
	, _initKeyboardEvent_type = (function( e ) {
	try {
	e.initKeyboardEvent(
	"keyup" // in DOMString typeArg
	, false // in boolean canBubbleArg
	, false // in boolean cancelableArg
	, global // in views::AbstractView viewArg

	requirejs.config({
	baseUrl: '/js',
	paths: {
	jquery: ['//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min','jquery.min'],
	bootstrap: 'bootstrap.min'
	},
	shim: {
	'bootstrap':{deps: ['jquery']}
	}
	});

	// there is a solution for jQuery < 1.9.0, where you can use `$.browser`:
	// https://gist.github.com/nathansmith/950767

	// but jQuery removed `$.browser` in version 1.9.0, so you have to get another way:

	function last_child() {
	if (/msie [1-8]{1}[^0-9]/.test(navigator.userAgent.toLowerCase())) {
	$('*:last-child').addClass('last-child');
	}
	}

	if (!jQuery.support.cors && window.XDomainRequest) {
	var httpRegEx = /^https?:\/\//i,
	getOrPostRegEx = /^get\|post$/i,
	sameSchemeRegEx = RegExp("^" + location.protocol, "i"),
	xmlRegEx = /\/xml/i;
	jQuery.ajaxTransport("text html xml json", function (e, t) {
	if (e.crossDomain && e.async && getOrPostRegEx.test(e.type) && httpRegEx.test(t.url) && sameSchemeRegEx.test(t.url)) {
	var n = null,
	i = (t.dataType \|\| "").toLowerCase();
	return {

Evan Portwood evanportwood

Security-Reviewing Uses of postMessage()

Title

Git

Global Settings

Reminder

Security-Reviewing Uses of `postMessage()`