1611087 - Iframe allow attribute doesn't support Wildcards

Status: RESOLVED DUPLICATE of bug 1609973

(Core :: DOM: Security, defect)

Description

[tobiasgraf87]

Attachment: iframe-allow-microphone-master.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36

Steps to reproduce:

When including a website within a Iframe the included website cannot access permissions which are given with the wildcard syntax.

Doesn't work:
iframe allow="microphone *"

On the other Hand allowing an specific Url works fine

 iframe allow="microphone http://localhost:9000" 

and finally even omitting the restriction with

 iframe allow="microphone" 

works as expected.

I created an example repo at github to make it more clear and testable
https://github.com/42tg/iframe-allow-microphone

Actual results:

When requesting the permission from the inner frame the promise doesn't resolve or reject in any way. It is just called but never handled. Wich makes the error handling quite hard.

Expected results:

The browser should respect the Wildcard and do the same when I omitting the "*" from the allow attribute.

Comment 1

[tobiasgraf87]

This is maybe related to the following cards

https://bugzilla.mozilla.org/show_bug.cgi?id=1600883
https://bugzilla.mozilla.org/show_bug.cgi?id=1483631

https://developer.mozilla.org/de/docs/Mozilla/Firefox/Releases/73#HTTP

Comment 2

[Augusto Pace]

Hi,

Unfortunately we don't count with the correct environment to run this confirmation test. As first step I'm setting component to Core - DOM: Security for someone to take a look at this.