2080758 - iframe allow PermissionsPolicy if the child allow it and parent block it

Status: RESOLVED DUPLICATE of bug 2081658

(Core :: DOM: Security, defect, P3)

Description

[ayoub]

TL;DR

A parent document at https://a.example.com sets the following Permissions-Policy header:

Permissions-Policy: fullscreen=(self)

The parent contains a cross-origin iframe:

<iframe src="https://b.example.com" allow="fullscreen *"></iframe>

The cross-origin iframe is still able to enter fullscreen, even though the parent's Permissions-Policy header restricts fullscreen to same-origin contexts.

Cause

in PermissionsPolicy::InheritPolicy we have

     if (!src->AllowsFeatureInternal(featureName, src->mDefaultOrigin) &&
          !src->AllowsFeatureInternal(featureName, dest->mDefaultOrigin)) {
        dest->SetInheritedDeniedFeature(featureName);
      }

The current condition denies the feature only when the source allowList disallows it for both the source own origin and the destination origin. However In the spec, these are separate steps. Therefore the two checks should be joined with || and not &&.

However doing just that fixed the issue but also made some regressions so I'll take a deeper look at what is going on