1114572 - sandbox allow-scripts

Status: NEW

(Core :: DOM: Copy & Paste and Drag & Drop, defect, P3)

Description

[polomski.piotr]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

Steps to reproduce:

Please visit test page with iframes http://msdrop.com/msdrop-jquery-test-iframe-frameset.htm

There are images or link, or use selected text for drag and drop on iframes. Just start dragging on A, B, C, D iframes for reproduce.

Iframe A src is from the same domain no sandbox sttribute
Iframe B src is from the other domain no sandbox sttribute
Iframe C src is from the same domain + sandbox="allow-scripts"
Iframe D src is from the other domain + sandbox="allow-scripts"



Actual results:

Iframe A - dragover, dragleave, drop works 
Iframe B - dragover, dragleave, drop works
Iframe C - dragover, dragleave, drop NOT works
Iframe D - dragover, dragleave, drop works


Expected results:

Iframe B - source is from other domain so dragover, dragleave, drop should NOT working without sandbox sttribute="allow-scripts"

Iframe C - scripts are allowed, and this is the same domain so dragover, dragleave, drop should working as in IFRAME A

Comment 1

[polomski.piotr]

Windows FireFox and Linux Iceweasel gives the same result.

In Chrome/Chromium and Internet Explorer on iframes B, C, D dragover, dragleave, drop NOT works 

But in Opera on iframes B, C, D dragover, dragleave and drop works.

Comment 2

[Tanvi Vyas[:tanvi]]

Hi Olli,
Can you take a look at this bug?  Is this an issue we need to fix?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Clearing the priority/severity to get this back to triaging.

Comment 4

[Hsin-Yi Tsai (she/her) [:hsinyi]]

We/Nightly 116 behaves the same as Chrome and Edge for all the cases:

Iframe A src is from the same domain no sandbox sttribute: dragover, dragleave, drop works
Iframe B src is from the other domain no sandbox sttribute: dragover, dragleave, drop NOT working
Iframe C src is from the same domain + sandbox="allow-scripts": dragover, dragleave, drop NOT working
Iframe D src is from the other domain + sandbox="allow-scripts": dragover, dragleave, drop NOT working

Is this the expected behavior?