1398073 - Firefox does not block a frame with origin "null" from accessing a cross-origin frame

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Jose María Acuña]

Go to:

data:text/html,<iframe src="data:text/html,<iframe src='data:text/html,<iframe src=javascript:alert(parent.parent.top.frames[0].location);></iframe>'></iframe>"></iframe>

Access to the frame source may cause unwanted effects such as the following example:

data:text/html,<iframe name='javascript:location.replace("https://feeds.feedburner.com/GoogleInbox");' src="data:text/html,<script>parent.top.setInterval(function(){parent.top.location.reload();},2000);</script><iframe src='data:text/html,<iframe src=javascript:parent.top.frames[0].frames[0].location=parent.top.frames[0].name;></iframe>'></iframe>"></iframe>

Tested on Firefox 55.0.3 (64-bit)


Firefox Nightly 57.0a1 returns the error:

- SecurityError: Permission denied to access property Symbol.toPrimitive on cross-origin object

Comment 1

[Jose María Acuña]

Attachment: cross-origin.webm

Comment 2

[Boris Zbarsky [:bzbarsky]]

Those are same-origin iframes in Firefox 55 because data: inherits the origin of its loader.  I don't think this should be security-sensitive: this is a longstanding and well-documented behavior.

On nightly we are considering changing it, which is why there you get a security error.

Comment 3

[Jose María Acuña]

(In reply to Boris Zbarsky [:bz] (still digging out from vacation mail) from comment #2)
> Those are same-origin iframes in Firefox 55 because data: inherits the
> origin of its loader.  I don't think this should be security-sensitive: this
> is a longstanding and well-documented behavior.
> 
> On nightly we are considering changing it, which is why there you get a
> security error.

It is strange that chrome also blocks the navigation between iframes.

Comment 4

[Ethan Tseng [:ethan]]

(In reply to Boris Zbarsky [:bz] (still digging out from vacation mail) from comment #2)
> On nightly we are considering changing it, which is why there you get a
> security error.

This is the expected behavior since we changed the inheritance for data: URLs.
The meta bug is bug 1324406 - Treat 'data:' documents as unique, opaque origins.