title: Is it possible to block remote scripts from loading inside iframe?
body: <p>I am creating iframes dynamically and I want to prevent scripts that don't originate from the iframes' origin. Is this even possible (via JavaScript/jQuery)? For example, if my page loads an iframe from <code>example.com</code> with the contents:</p>
  
  <pre><code>&lt;script src="http://example.com/foo.js"&gt;&lt;/script&gt;
  &lt;script src="http://something-else.com/bar.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>I want the <code>example.com</code> script to run, but I want the <code>something-else.com</code> script to be blocked and not run.</p>
  
  <p>I am using <a href="https://github.com/nwjs/nw.js/tree/master" rel="nofollow">NW.js</a> (formerly Node-Webkit), so I have full read-write access to the iframes' contents as if they were same-origin.</p>
  
  <p>I've tried using plugins (like those that bring CORS in the picture, with whitelisting), but nothing I've tried is working.</p>
  
  <p>An ideal solution would also allow me to whitelist specific other origins in addition to the iframe's origin.</p>
  
  <p>EDIT:</p>
  
  <p>Here is my browser project I am trying to implement this in: <a href="https://github.com/IdeasNeverCease/Aries" rel="nofollow">https://github.com/IdeasNeverCease/Aries</a></p>
  
  <p>Here is the section of code the iframe loading is done in: <a href="https://github.com/IdeasNeverCease/Aries/blob/master/app.nw/resources/scripts/aries.js#L376-L687" rel="nofollow">https://github.com/IdeasNeverCease/Aries/blob/master/app.nw/resources/scripts/aries.js#L376-L687</a></p>