1446065 - Stop allowing most about: pages in content frames

Status: NEW

(Core :: DOM: Navigation, enhancement, P3)

Description

[:Gijs (he/him)]

While the MAKE_LINKABLE flag controls whether content can (directly) trigger loads of a particular about: page, some pages can still end up being loaded (e.g. about:feeds, see bug 1445106.


Similar to bug 1320124, I wonder if it makes sense to disallow codebase principal'd about: page documents in frames unless the about: page has some kind of flag (which we'd want to add to about:blocked, neterror, certerror, about:blank, and maybe about:srcdoc - but not anything else that I can think of off-hand).

The only downside I can think of is that some of the security checks we do right now rely on documentURI, and that wouldn't be changed by doing this (alone). It's possible we would want to change those checks as well, or also change the documentURI. I haven't thought about the best option there very hard.