850699 - Uncaught exception when "Load denied by X-Frame-Options" error is thrown

Status: UNCONFIRMED

(Core :: Security, defect)

Description

[matt.titchener]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130201065344

Steps to reproduce:

Add an iframe to the DOM with a URL that responds with a restrictive X-Frame-Options header, within a try-catch.


Actual results:

The try-catch does not catch the "Load denied by X-Frame-Options" (even though the console does).


Expected results:

The try-catch should catch the "Load denied by X-Frame-Options" error, allowing for alternative behaviour defined by the developer (e.g. display a user-friendly message to the user).

If the very act of detecting a "Load denied by X-Frame-Options" error is a security risk, perhaps not firing the iframe.onload event would suffice (this is the behaviour in Chrome, and provides a Good Enough workaround).

Comment 1

[Matthias Versen [:Matti]]

Could you please provide a testcase ?

Comment 2

[Boris Zbarsky [:bzbarsky]]

"Load denied by X-Frame-Options" is not a JS exception; it's just an error reported to the console for debugging purposes.

It sounds like what you _actually_ want is a way to detect whether the load was denied, correct?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Note that whether onload is fired here or not is covered by the spec; I believe the spec requires it to be fired.

Comment 4

[matt.titchener]

I've added a URL to a test case, but given Boris' comments, it might not be too much use.

Comment 5

[matt.titchener]

(In reply to Boris Zbarsky (:bz) from comment #2)
> "Load denied by X-Frame-Options" is not a JS exception; it's just an error
> reported to the console for debugging purposes.
> 
> It sounds like what you _actually_ want is a way to detect whether the load
> was denied, correct?

Boris, that's right, being able to detect a X-frame-Options error client-side is the ultimate goal of my inquired. Thanks for your time so far.