1354555 - iframe sandbox allow top navigation bypass

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36

Steps to reproduce:

1. Go to https://vuln.shhnjk.com/sandbox.php?url=//test.shhnjk.com/open.php?url=bypass_top_nav.html&s=allow-same-origin+allow-popups+allow-popups-to-escape-sandbox
2. Click on target_blank link.


Actual results:

Top document is navigated through iframe sandbox without allow-top-navigation flag.


Expected results:

opener.top.location.replace() should be prohibited because allow-top-navigation flag is not set in the sandbox.

Comment 1

[:Gijs (he/him)]

Bob/Bobby, this seems like your bailiwick per bug 785310?

Comment 2

[Bob Owen (:bobowen)]

You've added allow-popups-to-escape-sandbox, so the browsing context opened via the link is not sandboxed and there is nothing stopping it doing opener.top.location.replace().

Comment 3

[Jun (Request needinfo for comment, I ignore other updates)]

Hmm, Chrome does not allow redirect though.

Comment 4

[Bob Owen (:bobowen)]

(In reply to s.h.h.n.j.k from comment #3)
> Hmm, Chrome does not allow redirect though.

That's nothing to do with the sandbox though.
If you remove the sandbox altogether, I think you'll get the same result.
In my opinion as far as the spec is concerned that is a bug in Chrome.

Chrome, appears to be using some version of "familiar with" [1] as well as "allowed to navigate" [2] to decide if a browsing context can navigate another browsing context.

My understanding is that "familiar with" only comes into play, as far as navigation is concerned, when targeting a browsing context using its name.
In your test you are getting to the window through DOM attributes, so "familiar with" doesn't come into play as far as the spec is concerned.

[1] https://html.spec.whatwg.org/multipage/browsers.html#familiar-with
[2] https://html.spec.whatwg.org/multipage/browsers.html#allowed-to-navigate