1844494 - Prompt titles show spoofy generic "this site" with iframe Sandbox

Status: RESOLVED DUPLICATE of bug 1789495

(Core :: DOM: Core & HTML, defect)

Description

[Kang Ali]

Attachment: POC.mp4

Bypass Cors Origin can bypass sandbox="allow-scripts allow-popups allow-modals"
if not include sandbox domain origin show, but if include sandbox origin domain not show

Script Testing :

• orrigin.html in domain URL
• ifr.html in localhost

Reproduce in

Firefox Version : 115.0.2 (64-bit)
OS : Windows 11

Detail Video and script in attachment

Thanks

Comment 1

[Kang Ali]

Attachment: ifr.html

Comment 2

[Kang Ali]

Attachment: orrigin.html

Comment 3

[Kang Ali]

Attachment: POC_Android.mp4

Reproduce in

Android Firefox Version : 115.2.0
OS : Android

Comment 4

[Daniel Veditz [:dveditz]]

I do not see any use of CORS in this test whatsoever. What am I missing?

Comment 5

[Kang Ali]

Sorry im missing
Yes this not cors bypass but bypass url prompt not show url organ

Thanks

Comment 6

[Daniel Veditz [:dveditz]]

See discussion in bug 1844642 comment 2 and 3 — this is the same issue, just different ways to create an opaque origin. It's possible we would want to treat "sandbox" (explicitly untrusted) content differently from non-sandboxed data: urls. There are probably one or two other cases where we end up with a null origin and it would have the same issue.

The current behavior is well known (problems and all). we aren't protecting people by keeping this hidden

Comment 8

[Daniel Veditz [:dveditz]]

Actually we already had a bug about needing a different prompt title for sandboxed content