1148031 - BroadcastChannel API bypasses app sandbox on B2G

Status: RESOLVED DUPLICATE of bug 1148033

(Core :: DOM: Core & HTML, defect)

Description

[Muneaki Nishimura]

Attachment: victim.zip

User Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2342.2 Safari/537.36

Steps to reproduce:

1. Install attached packaged app 'victim.zip' on Firefox OS simulator 3.0.
2. Start the victim app. The app loads message receiver page from http://csrf.jp on it's iframe.
3. Start Browser app and open 'http://csrf.jp/bc/sender.html'.
4. Push 'Send Message' button in the page, and then, BroadcastChannel message is sent.
5. Open the victim app again. Then, you can see the received message from Browser on the alert popup.


Actual results:

BroadcastChannel message is delivered to other apps with bypassing app sandbox on B2G.



Expected results:

The message sent from Browser app should not be delivered to other apps, i.e., victim app in this scenario.
Note that this bug was origiinally reported in [Issue 1] in Bug 1147778.

Comment 1

[Daniel Veditz [:dveditz]]

I'm not sure I see a difference between this bug and 1148033 -- either we're respecting the containers or we aren't.

Comment 2

[Andrea Marchesini [:baku]]

I'm fixing this issue in bug 1148033.