1516054 - iframe sandbox:allow-scripts warn security issue

Status: UNCONFIRMED

(Core :: Security, defect)

Description

[sapics]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce:

Please look at test page in https://codepen.io/sapics/pen/maWzBb

I create an iframe which includes sandbox="allow-scripts" and input password.



Actual results:

Firefox warn "This connection is not secure. Logins entered here could be compromised" in password form.

I confirm this issue in firefox v64 japanese version with Windows and Mac. When I use Firefox ESR v60 in windows, there are no security warning.


Expected results:

I guess that there are two possible ways. (First one looks better, because non-firefox browsers do not warn about this form.)

i. If original page and iframe page include only https source, it should not warn security issue.

ii. If there are some security issues in password form of iframe, it should also warn in iframe which do not have sandbox attribution. (Bacause no sandbox attribution is less sucure as https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe.)