1555607 - unattended CSP propagation from iframe to parent window

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect)

Description

[paki37094]

Attachment: csp_propagation.zip

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

Create an html blob with some CSP rules, putting it in an iframe. Then try do fetch something that should not be restricted in this page but only in the iframe blob with a little delay (ex: setTimeout 200).

You can test the code provided by opening the testblob2.html inside the archive provided (you need to extract all the files inside the same folder so the relative urls can work properly).

Actual results:

blocking the fetch

Expected results:

not blocking the fetch

Comment 1

[Daniel Veditz [:dveditz]]

This is probably fixed in Nightly with the new place where CSP is stored (we had the same problem with data: urls, documented in another bug I can't find at the moment). Can you try this in Nightly and see if this is fixed for you now?

Comment 2

[paki37094]

It's fixed !