window.alert not being restricted by iframe sandbox

RESOLVED DUPLICATE of bug 1190641

Status

()

RESOLVED DUPLICATE of bug 1190641
2 years ago
2 years ago

People

(Reporter: jpmunz, Unassigned)

Tracking

47 Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

157 bytes, text/html
Details
(Reporter)

Description

2 years ago
Created attachment 8772510 [details]
test.html

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160623154057

Steps to reproduce:

Open the attached html file in FF 47.0.1 and click the X button


Actual results:

An alert popup is shown


Expected results:

Since the iframe that triggered the popup has 'sandbox="allow-scripts"' the action shouldn't have been allowed. From https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#attr-sandbox this should only be allowed if 'sandbox="allow-scripts allow-modals"'

Updated

2 years ago
Component: Untriaged → DOM: Security
Product: Firefox → Core
As shown in the compatibility section at the bottom of that MDN page, allow-modals wasn't added until Firefox 49. You can test this in our current "Dev Edition". This probably ought to be a dupe of the bug that implemented the feature, but I'm too lazy to look that up right now so I'll mark it worksforme.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME

Updated

2 years ago
Resolution: WORKSFORME → DUPLICATE
Duplicate of bug: 1190641
You need to log in before you can comment on or make changes to this bug.