Iframes/Popups Are Dangerous in Mobile Webview: Studying and Mitigating Differential Context Vulnerabilities

Total Page:16

File Type:pdf, Size:1020Kb

Iframes/Popups Are Dangerous in Mobile Webview: Studying and Mitigating Differential Context Vulnerabilities Iframes/Popups Are Dangerous in Mobile WebView: Studying and Mitigating Differential Context Vulnerabilities GuangLiang Yang, Jeff Huang, and Guofei Gu, Texas A&M University https://www.usenix.org/conference/usenixsecurity19/presentation/yang-guangliang This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. Iframes/Popups Are Dangerous in Mobile WebView: Studying and Mitigating Differential Context Vulnerabilities GuangLiang Yang, Jeff Huang, Guofei Gu Texas A&M University {ygl, jeffhuang, guofei}@tamu.edu Abstract Inconsistencies Between Browsers and WebView. How- ever, in WebView, a totally different working environment In this paper, we present a novel class of Android Web- is provided for iframes/popups, due to WebView’s own pro- View vulnerabilities (called Differential Context Vulnerabili- gramming and UI features. Although these features improve ties or DCVs) associated with web iframe/popup behaviors. app performance and user experience, they extensively impact To demonstrate the security implications of DCVs, we de- iframe/popup behaviors and introduce security concerns. In vise several novel concrete attacks. We show an untrusted particular, WebView enables several programming APIs (Fig- web iframe/popup inside WebView becomes dangerous that ure1) to help developers customize iframe/popup behaviors. it can launch these attacks to open holes on existing defense For example, the setting APIs allow developers to configure solutions, and obtain risky privileges and abilities, such as their WebView instances. In the customized web environment breaking web messaging integrity, stealthily accessing sensi- (WebView), it is unclear whether existing iframe/popup pro- tive mobile functionalities, and performing phishing attacks. tection solutions are still effective. Then, we study and assess the security impacts of DCVs on real-world apps. For this purpose, we develop a novel tech- Furthermore, WebView UI is designed in a simple style nique, DCV-Hunter, that can automatically vet Android apps (Figure2) that only one UI area for rendering web content is against DCVs. By applying DCV-Hunter on a large number provided. Due to the lack of the address bar, it is difficult for of most popular apps, we find DCVs are prevalent. Many high- users to learn what web content is being loaded; due to the profile apps are verified to be impacted, such as Facebook, lack of the tab bar, it is unknown how multiple WebView UI Instagram, Facebook Messenger, Google News, Skype, Uber, instances (WUIs) are managed. Therefore, if an iframe/popup Yelp, and U.S. Bank. To mitigate DCVs, we design a multi- has abilities to secretly navigate the main frame (the top level solution that enhances the security of WebView. Our frame) or put their own WUI to the foremost position for evaluation on real-world apps shows the mitigation solution overlaying the original WUI, phishing attacks occur and may is effective and scalable, with negligible overhead. cause serious consequences. Consider the scenario shown in Figure3 and4. The Huntington banking app (one million+ 1 Introduction downloads) uses WebView to help users reset passwords (Fig- ure3-a,b). Inside WebView, the main frame contains an iframe Nowadays, mobile app developers enjoy the benefits of the for isolatedly loading untrusted third-party tracking content amalgamation of web and mobile techniques. They can easily (Figure4). However, if the untrusted web content inside the and smoothly integrate all sorts of web services in their apps iframe obtains the ability of stealthily redirecting the main (hybrid apps) by embedding the browser-like UI component frame to a fake website (Figure3-c), serious security risks are “WebView”. WebView is as powerful as regular web browsers posed. For example, users’ personal (e.g., SSN info and Tax (e.g., desktop browsers), and well supports web features, in- ID) and bank account information may be stolen, and further cluding the utilization of iframes/popups. financial losses may also be caused. In the web platform, iframes/popups are frequently used, but also often the root cause of several critical security is- Differential Context Vulnerability (DCV). Motivated by sues (e.g., frame hijacking [11] and clickjacking [23, 43]). above security concerns, we conduct the first security study of In past years, in regular browsers, their behaviors have been iframe/popup behaviors in the context of Android WebView. well studied, and a variety of mature iframe/popup protec- In this paper, we use the term “context” to refer to a web tion solutions (e.g., Same Origin Policy (SOP) [6], HTML5 environment that includes GUI elements (e.g., the address iframe sandbox [4], and navigation policies [11]) have been and tab bars), corresponding web management APIs (e.g., the deployed. setting APIs in WebView), and security policies (e.g., SOP USENIX Association 28th USENIX Security Symposium 977 Table 1: A Summary of Differential Context Vulnerabilities (DCVs) Critical Features Different Contexts Attacks Explanations Consequences & Behaviors Browsers WebView Sensitive functionalities behind postMessage and JavaScript Bridges can be leveraged, Main-Frame Address Special common origins Java APIs Origin Hiding Attack which may cause the leakage of sensitive Creation Bar (e.g., null) Of Main-Frame information (e.g., location), and risky access on Hardware (e.g., camera and microphone) Management of Android WUI overlap attack No protection on the WUI Tab Bar new popups Frameworks WUI closure attack rendering sequence Traditional navigation Permissive navigation Phishing attacks based attack policies Main-Frame Address Java APIs Harmful conflict between Navigation Bar Privileged navigation WebView Customizations attack and web APIs and navigation policies). As a consequence, our study uncovers a novel class of vulnerabilities and design flaws in WebView. These vulner- abilities are rooted in the inconsistencies between different contexts of regular browsers and WebView. As summarized in Table1, several critical web features and behaviors (i.e., main- frame creation, popup creation, and main-frame navigation) Figure 1: WebView Programming Features are involved (see more details in Section3). These features and behaviors are harmless or even safe in the context of regular browsers, but become risky and dangerous in the con- 1) For origin-hiding attacks, existing defense solutions for text of WebView. To demonstrate their security implications, postMessage [11, 44, 47, 52] and web-mobile bridges we devise several concrete attacks. We show through these [18, 21, 38, 45, 49] usually provide security enforcement attacks, remote adversaries (e.g., web or network attackers relying on origin validation. However, unfortunately, the on iframes/popups) can obtain several unexpected and risky key origin information of the untrusted iframe/popup can privileges and abilities: be hidden during attacks, which leads to the bypass of the security enforcement. Origin-Hiding 1) : hiding the origin when 2) For WUI redressing attacks, they are similar to Android • breaking the integrity of web messaging (i.e., postMes- UI redressing attacks [15, 20, 35]. However, the associ- sage) [8], which allows the communication between ated Android UI protection solutions (e.g., [13, 41]) are mutually distrusted web frames; and circumscribed to prevent WUI addressing attacks. This is • secretly accessing web-mobile bridges [21], which link mainly because that these protections work by monitoring mobile native the web layer with the or layer (e.g., Java exceptional Android UI state changes between different for Android) (Figure1); apps, while the WUI state change occurs within an app Existing work has shown that postMessage’s message during attacks. receivers [44, 47] and web-mobile bridges [21, 49, 53] 3) For main-frame navigation attacks, one related solution is often carry sensitive functionalities. Thus, these function- the iframe sandbox security mechanism, which can effec- alities can be further stealthily accessed by the untrusted tively limit the navigation capability of an arbitrary iframe. iframe/popup through the attack. As a result, sensitive However, through DCV attacks, an untrusted iframe can information (e.g., GPS location) may be stolen, and impor- still break the above limitation and cause privilege escala- tant hardware (e.g., microphone) may be unauthorizedly tion. accessed. 2) WebView UI Redressing: performing phishing attacks by More details about the vulnerabilities and the weakness of overlapping the foremost benign WUI with an untrusted existing defense solutions are presented in Section3. For WUI; convenience, considering the root reason of this new type of 3) (Privileged) Main-Frame Navigation: freely redirecting vulnerability (i.e., the inconsistencies between the contexts of the main frame to a fake website. regular browsers and WebView), we refer to the vulnerabili- ties as Differential Context Vulnerabilities or DCVs, and the Moreover, we examine the effectiveness of existing protec- associated attacks as DCV attacks. tion solutions, which include not only the solutions designed for regular browsers (inherited by WebView), but also the DCV-Hunter & Findings. We next study and assess the se- solutions proposed for Android UI and WebView. We find curity impact of DCVs on real-world hybrid apps. To achieve that these solutions are
Recommended publications
  • Webgl™ Optimizations for Mobile
    WebGL™ Optimizations for Mobile Lorenzo Dal Col Senior Software Engineer, ARM 1 Agenda 1. Introduction to WebGL™ on mobile . Rendering Pipeline . Locate the bottleneck 2. Performance analysis and debugging tools for WebGL . Generic optimization tips 3. PlayCanvas experience . WebGL Inspector 4. Use case: PlayCanvas Swooop . ARM® DS-5 Streamline . ARM Mali™ Graphics Debugger 5. Q & A 2 Bring the Power of OpenGL® ES to Mobile Browsers What is WebGL™? Why WebGL? . A cross-platform, royalty free web . It brings plug-in free 3D to the web, standard implemented right into the browser. Low-level 3D graphics API . Major browser vendors are members of . Based on OpenGL® ES 2.0 the WebGL Working Group: . A shader based API using GLSL . Apple (Safari® browser) . Mozilla (Firefox® browser) (OpenGL Shading Language) . Google (Chrome™ browser) . Opera (Opera™ browser) . Some concessions made to JavaScript™ (memory management) 3 Introduction to WebGL™ . How does it fit in a web browser? . You use JavaScript™ to control it. Your JavaScript is embedded in HTML5 and uses its Canvas element to draw on. What do you need to start creating graphics? . Obtain WebGLrenderingContext object for a given HTMLCanvasElement. It creates a drawing buffer into which the API calls are rendered. For example: var canvas = document.getElementById('canvas1'); var gl = canvas.getContext('webgl'); canvas.width = newWidth; canvas.height = newHeight; gl.viewport(0, 0, canvas.width, canvas.height); 4 WebGL™ Stack What is happening when a WebGL page is loaded . User enters URL . HTTP stack requests the HTML page Browser . Additional requests will be necessary to get Space User JavaScript™ code and other resources WebKit JavaScript Engine .
    [Show full text]
  • Chapter 10 Document Object Model and Dynamic HTML
    Chapter 10 Document Object Model and Dynamic HTML The term Dynamic HTML, often abbreviated as DHTML, refers to the technique of making Web pages dynamic by client-side scripting to manipulate the document content and presen- tation. Web pages can be made more lively, dynamic, or interactive by DHTML techniques. With DHTML you can prescribe actions triggered by browser events to make the page more lively and responsive. Such actions may alter the content and appearance of any parts of the page. The changes are fast and e±cient because they are made by the browser without having to network with any servers. Typically the client-side scripting is written in Javascript which is being standardized. Chapter 9 already introduced Javascript and basic techniques for making Web pages dynamic. Contrary to what the name may suggest, DHTML is not a markup language or a software tool. It is a technique to make dynamic Web pages via client-side programming. In the past, DHTML relies on browser/vendor speci¯c features to work. Making such pages work for all browsers requires much e®ort, testing, and unnecessarily long programs. Standardization e®orts at W3C and elsewhere are making it possible to write standard- based DHTML that work for all compliant browsers. Standard-based DHTML involves three aspects: 447 448 CHAPTER 10. DOCUMENT OBJECT MODEL AND DYNAMIC HTML Figure 10.1: DOM Compliant Browser Browser Javascript DOM API XHTML Document 1. Javascript|for cross-browser scripting (Chapter 9) 2. Cascading Style Sheets (CSS)|for style and presentation control (Chapter 6) 3. Document Object Model (DOM)|for a uniform programming interface to access and manipulate the Web page as a document When these three aspects are combined, you get the ability to program changes in Web pages in reaction to user or browser generated events, and therefore to make HTML pages more dynamic.
    [Show full text]
  • Webgl: the Standard, the Practice and the Opportunity Web3d Conference August 2012
    WebGL: The Standard, the Practice and the Opportunity Web3D Conference August 2012 © Copyright Khronos Group 2012 | Page 1 Agenda and Speakers • 3D on the Web and the Khronos Ecosystem - Neil Trevett, NVIDIA and Khronos Group President • Hands On With WebGL - Ken Russell, Google and WebGL Working Group Chair © Copyright Khronos Group 2012 | Page 2 Khronos Connects Software to Silicon • Khronos APIs define processor acceleration capabilities - Graphics, video, audio, compute, vision and sensor processing APIs developed today define the functionality of platforms and devices tomorrow © Copyright Khronos Group 2012 | Page 3 APIs BY the Industry FOR the Industry • Khronos standards have strong industry momentum - 100s of man years invested by industry leading experts - Shipping on billions of devices and multiple operating systems • Khronos is OPEN for any company to join and participate - Standards are truly open – one company, one vote - Solid legal and Intellectual Property framework for industry cooperation - Khronos membership fees to cover expenses • Khronos APIs define core device acceleration functionality - Low-level “Foundation” functionality needed on every platform - Rigorous conformance tests for cross-vendor consistency • They are FREE - Members agree to not request royalties Silicon Software © Copyright Khronos Group 2012 | Page 4 Apple Over 100 members – any company worldwide is welcome to join Board of Promoters © Copyright Khronos Group 2012 | Page 5 API Standards Evolution WEB INTEROP, VISION MOBILE AND SENSORS DESKTOP OpenVL New API technology first evolves on high- Mobile is the new platform for Apps embrace mobility’s end platforms apps innovation. Mobile unique strengths and need Diverse platforms – mobile, TV, APIs unlock hardware and complex, interoperating APIs embedded – mean HTML5 will conserve battery life with rich sensory inputs become increasingly important e.g.
    [Show full text]
  • Khronos Open API Standards for Mobile Graphics, Compute And
    Open API Standards for Mobile Graphics, Compute and Vision Processing GTC, March 2014 Neil Trevett Vice President Mobile Ecosystem, NVIDIA President Khronos © Copyright Khronos Group 2014 - Page 1 Khronos Connects Software to Silicon Open Consortium creating ROYALTY-FREE, OPEN STANDARD APIs for hardware acceleration Defining the roadmap for low-level silicon interfaces needed on every platform Graphics, compute, rich media, vision, sensor and camera processing Rigorous specifications AND conformance tests for cross- vendor portability Acceleration APIs BY the Industry FOR the Industry Well over a BILLION people use Khronos APIs Every Day… © Copyright Khronos Group 2014 - Page 2 Khronos Standards 3D Asset Handling - 3D authoring asset interchange - 3D asset transmission format with compression Visual Computing - 3D Graphics - Heterogeneous Parallel Computing Over 100 companies defining royalty-free APIs to connect software to silicon Camera Control API Acceleration in HTML5 - 3D in browser – no Plug-in - Heterogeneous computing for JavaScript Sensor Processing - Vision Acceleration - Camera Control - Sensor Fusion © Copyright Khronos Group 2014 - Page 3 The OpenGL Family OpenGL 4.4 is the industry’s most advanced 3D API Cross platform – Windows, Linux, Mac, Android Foundation for productivity apps Target for AAA engines and games The most pervasively available 3D API – 1.6 Billion devices and counting Almost every mobile and embedded device – inc. Android, iOS Bringing proven desktop functionality to mobile JavaScript binding to OpenGL
    [Show full text]
  • 01 Creation of HTML Pages with Frames, Links, Tables and Other Tags Date
    www.vidyarthiplus.com Ex. No. : 01 Creation of HTML pages with frames, links, tables and other tags Date : AIM: To create a simple webpage using HTML that includes all tags. ALGORITHM: 1. Write a HTML program in the notepad with the tags such as A. FRAMES With frames, you can display more than one HTML document in the same browser window. Each HTML document is called a frame, and each frame is independent of the others. The Frameset Tag The <frameset> tag defines how to divide the window into frames. The Frame Tag The <frame> tag defines what HTML document to put into each frame. Example: <frameset cols="25%, 75 %"> <frame src="frame_a.htm"> <frame src="frame_b.htm"> </frameset> Tags and their Description: <frameset> Defines a set of frames <frame> Defines a sub window (a frame) www.vidyarthiplus.com www.vidyarthiplus.com B. LINKS A hyperlink is a reference (an address) to a resource on the web. Example: <a href="http://www.w3schools.com/">Visit W3Schools!</a> The href Attribute The href attribute defines the link "address". The target Attribute The target attribute defines where the linked document will be opened. Tag and its Description: <a> Defines an anchor C. TABLES Tables are defined with the <table> tag. A table is divided into rows (with the <tr> tag), and each row is divided into data cells (with the <td> tag). The letters td stands for "table data," which is the content of a data cell. Example: <table border="1"> <tr> <td>Row 1, cell 1</td> <td>Row 1, cell 2</td> </tr> </table> Tags and their Description: <Table> Defines a table <th> Defines a table header <tr> Defines a table row <td> Defines a table cell 2.
    [Show full text]
  • 23-Introduction-To-CSS.Pdf
    Introduction to CSS Jerry Cain CS 106AX November 13, 2019 Introducing CSS • Recall that there are three technologies that are typically employed when implementing interactive web pages. – HTML: which dictates the structure and content of a web page – JavaScript: which implements animations and user interactivity and otherwise control the behavior of the elements – CSS: short for Cascading Style Sheets, controls layout, formatting, and presentation • Any nontrivial web application will require a large amount of HTML, CSS, and JavaScript. – As web applications grow in complexity, it’s important to decouple the HTML, CSS, and JavaScript as much as possible that that changes to an HTML document never break a CSS rule or compromise the execution of JavaScript event handler. – Web applications that successfully separate content, presentation, and interactivity are easier to modify and maintain. CSS Declarations • Web designers control the presentation of a page using one or more CSS declarations, each of which is structured like this: property-name: property-value; • The property name is one of several CSS keywords (567 according to https://www.w3.org) that identify some detail related to presentation. • The set of possible property values depends on the name. – background-color can take on any legal JavaScript or CSS color, e.g. green, rgb(85, 172, 238), or #E98725. – text-align governs the horizontal alignment of text and can be set to left, right, center, or justify. – display controls how an element is displayed and can be bound to inline,
    [Show full text]
  • Document Object Model †DOM‡ Level 1 Specification
    Document Object Model (DOM) Level 1 Specification REC-DOM-Level-1-19981001 Document Object Model (DOM) Level 1 Specification Version 1.0 W3C Recommendation 1 October, 1998 This version http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001 http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/DOM.ps http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/DOM.pdf http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/DOM.tgz http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/DOM.zip http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/DOM.txt Latest version http://www.w3.org/TR/REC-DOM-Level-1 Previous versions http://www.w3.org/TR/1998/PR-DOM-Level-1-19980818 http://www.w3.org/TR/1998/WD-DOM-19980720 http://www.w3.org/TR/1998/WD-DOM-19980416 http://www.w3.org/TR/WD-DOM-19980318 http://www.w3.org/TR/WD-DOM-971209 http://www.w3.org/TR/WD-DOM-971009 WG Chair Lauren Wood, SoftQuad, Inc. Editors Vidur Apparao, Netscape Steve Byrne, Sun Mike Champion, ArborText Scott Isaacs, Microsoft Ian Jacobs, W3C Arnaud Le Hors, W3C Gavin Nicol, Inso EPS Jonathan Robie, Texcel Research Robert Sutor, IBM Chris Wilson, Microsoft Lauren Wood, SoftQuad, Inc. Principal Contributors Vidur Apparao, Netscape Steve Byrne, Sun (until November 1997) Mike Champion, ArborText, Inc. 1 Status of this document Scott Isaacs, Microsoft (until January, 1998) Arnaud Le Hors, W3C Gavin Nicol, Inso EPS Jonathan Robie, Texcel Research Peter Sharpe, SoftQuad, Inc. Bill Smith, Sun (after November 1997) Jared Sorensen, Novell Robert Sutor, IBM Ray Whitmer, iMall Chris Wilson, Microsoft (after January, 1998) Status of this document This document has been reviewed by W3C Members and other interested parties and has been endorsed by the Director as a W3C Recommendation.
    [Show full text]
  • HTML 4.0 Specification
    HTML 4.0 Specification REC-html40-19980424 HTML 4.0 Specification W3C Recommendation, revised on 24-Apr-1998 This version: http://www.w3.org/TR/1998/REC-html40-19980424 Latest version: http://www.w3.org/TR/REC-html40 Previous version: http://www.w3.org/TR/REC-html40-971218 Editors: Dave Raggett <[email protected]> Arnaud Le Hors <[email protected]> Ian Jacobs <[email protected]> Abstract This specification defines the HyperText Markup Language (HTML), version 4.0, the publishing language of the World Wide Web. In addition to the text, multimedia, and hyperlink features of the previous versions of HTML, HTML 4.0 supports more multimedia options, scripting languages, style sheets, better printing facilities, and documents that are more accessible to users with disabilities. HTML 4.0 also takes great strides towards the internationalization of documents, with the goal of making the Web truly World Wide. HTML 4.0 is an SGML application conforming to International Standard ISO 8879 -- Standard Generalized Markup Language [ISO8879] [p.327] . Status of this document This document has been reviewed by W3C Members and other interested parties and has been endorsed by the Director as a W3C Recommendation. It is a stable document and may be used as reference material or cited as a normative reference from another document. W3C’s role in making the Recommendation is to draw attention to the specification and to promote its widespread deployment. This enhances the functionality and interoperability of the Web. W3C recommends that user agents and authors (and in particular, authoring tools) produce HTML 4.0 documents rather than HTML 3.2 documents (see [HTML32] [p.329] ).
    [Show full text]
  • Document Object Model †DOM‡ Level 2 HTML Specification
    Document Object Model (DOM) Level 2 HTML Specification Document Object Model (DOM) Level 2 HTML Specification Version 1.0 W3C Candidate Recommendation 07 October 2002 This version: http://www.w3.org/TR/2002/CR-DOM-Level-2-HTML-20021007 Latest version: http://www.w3.org/TR/DOM-Level-2-HTML Previous version: http://www.w3.org/TR/2002/CR-DOM-Level-2-HTML-20020605 Editors: Johnny Stenback, Netscape Philippe Le Hégaret, W3C Arnaud Le Hors, W3C and IBM (until November 2000) This document is also available in these non-normative formats: XML fileplain text, PostScript file, PDF file, single HTML file, and ZIP file. Copyright ©2002 W3C ® (MIT, INRIA, Keio), All Rights Reserved. W3C liability, trademark, document use and software licensing rules apply. Abstract This specification defines the Document Object Model Level 2 HTML, a platform- and language-neutral interface that allows programs and scripts to dynamically access and update the content and structure of [HTML 4.01] and [XHTML 1.0] documents. The Document Object Model Level 2 HTML builds on the Document Object Model Level 2 Core [DOM Level 2 Core] and is not backward compatible with DOM Level 1 HTML [DOM Level 1]. Status of this document This section describes the status of this document at the time of its publication. Other documents may supersede this document. The latest status of this document series is maintained at the W3C. 1 Table of contents This is the 07 October 2002 W3C Candidate Recommendation of "DOM Level 2 HTML". This version updates the 5 June 2002 version based on the feedback from the implementers and the results of the DOM Level 2 HTML Test Suite.
    [Show full text]
  • How to Setup Petpoint's Adoptable Search I-Frame
    HOW TO SETUP PETPOINT’S ADOPTABLE SEARCH I-FRAME PetPoint | v.20101227 INTRODUCTION PetPoint’s Adoptable Search I-frame provides live adoptable pet data to your website, giving the world information about pets that are available in your shelter or rescue. Because it’s real-time, your website will be instantly updated when changes are made in PetPoint, such as when a pet is adopted. This document describes in detail the steps for adding PetPoint’s Adoptable Search I-frame to your website, including customization options. It additionally describes how to setup and update records in PetPoint so they are displayed in the I-frame. You will need to be able to edit the actual HTML code of pages on your website – either via your website provider’s Administrative utilities (ex. Convio’s PageBuilder) or by editing the files locally in a software application such as Dreamweaver and posting them to your site. Adding the Adoptable Search I-frame should only take a matter of minutes to complete – the process is very similar to adding a ShelterCare Bowl of Food Plus Program Banner Ad to your organization’s website. Should you have any questions on deploying PetPoint’s Adoptable Search I-frame after reviewing this document, please contact us at 866-630-7387 x400 or [email protected]. How to Setup PetPoint’s Adoptable Search I-frame v. 20101227 Page 2 of 15 TESTING YOUR CSS AND GENERATING YOUR SOURCE CODE You can now easily generate the Adoptable Search code using the Test page found here: http://www.petango.com/webservices/testAdoptableSearch.htm This page is also a good way to experiment with parameters and test your CSS files.
    [Show full text]
  • XHTML Frames
    IT350 Web and Internet Programming Fall 2006 SlideSet #5: Frames & SSI (from Chapter 5 & 26 of the text) Adapted from 2004 Prentice Hall, Inc. All rights reserved. Frames Example Adapted from 2004 Prentice Hall, Inc. All rights reserved. 1 Benefits of Frames Adapted from 2004 Prentice Hall, Inc. All rights reserved. Problems with Frames Result: XHTML 1.1 does not support frames Adapted from 2004 Prentice Hall, Inc. All rights reserved. 2 Making Pages with Frames • Two kinds of pages 1. “Frameset” page: A page with a <frameset> (usually the index.html page) DTD: must use “XHTML 1.0 Frameset” 2. “Content” page DTD: must use “XHTML 1.0 Transitional” Adapted from 2004 Prentice Hall, Inc. All rights reserved. “Frameset” page <?xml version = "1.0"?> index.html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> <html xmlns = "http://www.w3.org/1999/xhtml"> <head> <title>Internet and WWW How to Program - Main</title> </head> <!-- the <frameset> tag sets the frame dimensions --> <frameset cols = "110,*"> <!-- frame elements specify which pages --> <!-- are loaded into a given frame --> <frame name = "leftframe" src = "nav.html" /> <frame name = "main" src = "main.html" /> <noframes> <body> <p>This page uses frames, but your br /owser does not support them.</p> <p>Please, <a href = "nav.html">follow this link to br /owse our site without frames</a>.</p> </body> </noframes> </frameset> </html> 3 Content page 1 <?xml version = "1.0"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" nav.html 3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> (1 of 2) 4 5 <!-- Fig.
    [Show full text]
  • UNIT II Frames
    UNIT II Frames : Introduction Frames divide a single browser window into multiple, independent regions, each of which can display a different HTML document. You begin by created FRAMESET document, which sets up the "layout" by establishing the number of frames, their position and other characteristics. This frameset document is structural only and does not contain any of the content that will appear on the final web page. It does however, specify a URL reference for each frame, which will be the HTML document, or "normal" web page that will be displayed within it. Hyperlinks in one frame can update the contents of another frame through the use of the TARGET attribute. Frames are controversial, however. Like many other web elements, such as background graphics, animations, and font colors, they can be poorly handled and often irritating, so give it some careful thought before you use them. Advantages of Frames 1. They allow parts of the screen to remain static while other parts scroll. This can be useful for navigation menus or logos that you don't want to scroll off the screen. 2. They can be handy when you want the user to be able to view a number of images chosen from a long list. 2. You can introduce material from different servers on the same page, simply by assigning the appropriate URL's. Disadvantages of Frames 1. Navigating through a framed site can be challenging for many users, as the forward and back buttons do not work as expected. 2. Bookmarking a framed site is difficult, as only the top level document is noted.
    [Show full text]