1527882 - Enable the blocking of external protocol URLs in iframes

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P2)

Description

[Andrea Marchesini [:baku]]

dom.block_external_protocol_in_iframes is currently set to true only in nightly.
There are no reasons to block the shipping of this feature.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: Bug 1527882 - Enable the blocking of external protocol URLs in iframes, r=smaug

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bf504227f362
Enable the blocking of external protocol URLs in iframes, r=smaug

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/bf504227f362

Comment 4

[Chris Mills [:cmills]]

Note to MDN writers: note added to Fx67 rel notes about this: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/67#Security

In terms of other docs, you may want to consider adding BCD about this, or writing it up in a bit more detail on the <iframe> page.

Comment 5

[Chris Mills [:cmills]]

I decided to just add a BCD data point for this: https://github.com/mdn/browser-compat-data/pull/4089

I think the docs are complete.

Comment 6

[Kohei Yoshino]

Updated the site compatibility note to mention this bug: https://www.fxsitecompat.com/en-CA/docs/2019/loading-of-external-protocol-url-in-iframe-is-now-blocked/