knockout-popup-template - npm Package Compare versions

Comparing version 1.9.1 to 1.9.2

knockout.popupTemplate.js

@@ -362,3 +362,15 @@ /*
             if (!src || src.indexOf(origin) === 0) {
-                $(iframe).contents().each(callback);
+                // try...catch to protect against foreign iframes throwing
+                // "Failed to read the 'contentDocument' property from
+                // 'HTMLIFrameElement': Blocked a frame with origin ...
+                // from accessing a cross-origin frame."
+                // Apparently that can happen despite the above check,
+                // maybe because the iframe is missing a src attribute.
+                var $contents;
+                try {
+                    $contents = $(iframe).contents();
+                } catch (e) {}
+                if ($contents) {
+                    $contents.each(callback);
+                }
             }
@@ -365,0 +377,0 @@ });

package.json

@@ -5,3 +5,3 @@ {
   "main": "knockout.popupTemplate.js",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "contributors": [
@@ -8,0 +8,0 @@ {

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

38359

increased by1.59%

Lines of code

628

increased by1.95%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes