2019516 - `CSP: frame-ancestors *` allows framing inside an opaque null origin context.

Status: RESOLVED DUPLICATE of bug 1891477

(Core :: DOM: Security, defect)

Description

[Nikos Fanourakis]

Attachment: A zip file containing the described tests

Version:

• Mozilla Firefox Nightly 150.0a1 (BuildID: 20260225213126, User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Firefox/150.0)
• Mozilla Firefox Stable 147.0.2, 137.0.1
• Tor 15.0.5 (Firefox ESR 140.7.0), 14.0.9 (Firefox ESR 128.9.0)

OS: Ubuntu 22.04.3 LTS

Description:
When a document sets the response header Content-Security-Policy: frame-ancestors *, it is allowed to be framed inside an opaque null origin context.

The attached tests embed an <iframe> that sets Content-Security-Policy: frame-ancestors * inside an opaque null origin context.
In the first test, the <iframe> is embedded inside another <iframe> whose src is a data: URL embedding HTML, which by default has a null origin.
In the second test, the top-level document sets Content-Security-Policy: sandbox allow-scripts and embeds the <iframe> directly. As the sandbox directive lacks the allow-same-origin token, the top-level’s and <iframe>’s origin becomes null.
The embedded document prints the word “run” to the console when it is loaded.

Steps to Reproduce:

1. Serve the attached files from an HTTP web server with PHP enabled.
2. Visit fa-wildcard-data.php and fa-wildcard-csp-sandbox.php.
3. Open the browser console and observe whether “run” is printed for each file.

Observed Behavior:
The <iframe> is loaded and the console prints “run” in both tests.

Expected Behavior:
The <iframe> should be blocked.

Comparison with other Major Browsers:
Chrome, Opera, Brave, Edge, and WebKit block the <iframe>.

Important Notes:

• This behavior is related to Bugzilla issue 1891477, with additional coverage.
• The same behavior is observed when using <embed> or <object> elements instead of <iframe>.
• Chrome reports the following error message: Framing 'https://example.com/' violates the following Content Security Policy directive: "frame-ancestors *". The request has been blocked. Note that '*' matches only URLs with network schemes ('http', 'https', 'ws', 'wss'), or URLs whose scheme matches self's scheme. The scheme 'https:' must be added explicitly.

Comment 1

[Tom Schuster]

I would probably still call this a duplicate of bug 1891477.