1924826 - Possible download file from sandbox iframes

Status: RESOLVED DUPLICATE of bug 1791322

(GeckoView :: General, defect)

Description

[Kang Ali]

Attachment: repro_android.mp4

VULNERABILITY DETAILS

Content-Disposition Header:
In the server.py script, the Content-Disposition header is set to attachment for the download.txt file. This header indicates to the browser that the file should be downloaded rather than displayed inline.

<iframe src="http://192.168.1.7:8899/iframe.html" sandbox="allow-scripts allow-popups allow-same-origin" style="height:300px;width:500px;"></iframe>

OS : Android 14
Firefox Nightly : Version 133.0a1 (Build #2016049767)

REPRODUCTION CASE

Im testing in different Origin

index.html : running in http://127.0.0.1:6622/
iframe.html, iframe.js, download.txt, sw.js, server.py : running in http://127.0.0.1:8899/

1. Open index.html
2. Click Click anywhere in this iframe to trigger the download in iframe
3. Download Execute

Note :

• This not work in Firefox Desktop, Chrome
• This not work in Chrome and anything browser chromium in Android

Comment 1

[Kang Ali]

Attachment: index.html

Comment 2

[Kang Ali]

Attachment: iframe.html

Comment 3

[Kang Ali]

Attachment: iframe.js

Comment 4

[Kang Ali]

Attachment: sw.js

Comment 5

[Kang Ali]

Attachment: server.py

Comment 6

[Kang Ali]

Attachment: download.txt