Why Would Browser-Enabled InfoPath Form Error On Closing In An IFrame?

Question

I’ve observed that when a browser-enabled InfoPath form is viewed in an IFrame on a site (other than the hosting SharePoint site), it does not "close" nor return to the Library view when clicking a button with Rules to close the form. The form loads, performs rule behaviors and posts back correctly, but has a script error when clicking the "Close" button (script errors occurs in the SharePoint "Core.js" file with the message "Microsoft JScript runtime error: Permission denied".

Other Details:

• The site with the iFrame is CRM 4 that is in the same internal network and domain as the SharePoint 2010 site hosting the InfoPath form. iFrame in CRM set to allow cross-domain scripting
• The link to the form in the SharePoint library correctly has the Source parameter to know where to return on close
• Adding CRM & SharePoint sites to IE browser Trusted Sites didn’t change the results

Why would a browser-enabled InfoPath form error on closing in an IFrame?

Answer 1

I believe this is intended behavior to prevent XSS attacks.

I ran into a similar problem on a close button viewing a list item in a different web application. Same error.

http://www.zdnet.com/blog/security/serious-xss-flaw-haunts-microsoft-sharepoint/6346

https://www.google.com/search?q=sharepoint+xss