1933383 - Firefox 132 on Android mobile phones: An sandboxed iframe has a link in it, click on the link, can download (a sandboxed iframe's restriction bypass)

Status: RESOLVED DUPLICATE of bug 1791322

(Firefox for Android :: Browser Engine, defect)

Description

[Khiem Tran]

User Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Firefox for Android

Steps to reproduce:

On Firefox 132 on a Android mobile phone, create a website with an sandboxed iframe:

<iframe sandbox src="a cross-origin website"></iframe>

The cross-origin website's source code:

<a href="data:application/vnd.android.package-archive;base64,YWRtaW5pc3RyYXRvcg==">a normal link</a>

Load the website, click on the link on the sandboxed ifame, can download.

The online PoC:

https://akhiemtestblog.blogspot.com/2024/11/blog-post_25.html?m=1

https://akhiemtestblog.blogspot.com/2024/11/blog-post_25.html?m=1 iframe https://formsrctest.blogspot.com/2024/11/blog-post_9.html with sandbox.

Actual results:

Can download from clicking on a link directly put in a sandboxed iframe.

Expected results:

While this is a data: link, but as the download can happens as normal and the file can harm the users, it should be blocked as sandboxed iframe's restriction's standard does.

Comment 1

[Khiem Tran]

Attachment: iframe.html

Comment 2

[Khiem Tran]

Attachment: poc.html

Comment 3

[Emma Zühlcke [:emz]]

Sandboxing is controlled on the platform side. Moving the bug.

Comment 4

[Simon Friedberger [:simonf]]

I can reproduce the behavior.

We might not actually have implemented data: blocking on Android. Maybe we are not even using the code at https://searchfox.org/mozilla-central/source/netwerk/ipc/DocumentLoadListener.cpp#2565

Might be the same cause as https://bugzilla.mozilla.org/show_bug.cgi?id=1933377

Comment 5

[Daniel Veditz [:dveditz]]

Fenix has not implemented the allow-download sandbox attribute and does not currently block downloads from a sandboxed frame. Not related to 1933377 or data: urls