1010011 - Gecko should forbid embedding iframe which has different origins in src and mozAPP(manifest URL) attribute.

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[GaryChen [:GaryChen][:PYChen][:gchen][:陳柏宇]]

Embed iframe with different origins in src and mozAPP(manifest URL) attribute.
ex:
<iframe mozapp="app://abc.gaia/manifest.webapp" src="app://xyz.gaia/">

Expected result:
  Gecko will show error and kill the instance.
Actual:
  Gecko creates a instance for this iframe.

Comment 1

[[:fabrice] Fabrice Desré]

This will likely be more complex than a same-origin check. That needs to honor what has be called the "application scope" (there are a couple of mailing list threads about that) and it's not clear yet how we define these. That's important because this should be enforced not only when opening the iframe but also during navigation.

Comment 2

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.