1626651 - Disallow loading of plugins in sandboxed iframes

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Description

[dtapuska]

Attachment: Pdf Viewer in Sandboxed IFrame.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36

Steps to reproduce:

See crbug.com/1066827.
Or
Unzip attachment
Load index.html
Observe Chromium, Safari don't load plugins inside sandbox, Firefox does.

Actual results:

Chrome and Safari disallow the load.
Firefox allows it.

Expected results:

Chrome and Safari have disallowed the load since 2009. There even is some spec text that disallows this: https://html.spec.whatwg.org/multipage/origin.html#sandboxed-plugins-browsing-context-flag

But it is unclear how Firefox determines whether the plugin is secure or not. I propose that Firefox either define what "secure" is formally, or become similar to what Safari and Chromium have adopted.

Comment 1

[Haik Aftandilian [:haik]]

Transferring to Dom:Security because the sandbox here is referring to browsing context security and not OS process sandboxing.

Comment 2

[Daniel Veditz [:dveditz]]

Firefox natively renders PDFs, it is not a plugin. To us PDF is just another document type like text/html or text/xml+svg