951990 - Changing iframe sandbox by adding allow-same-origin has no effect

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Deian Stefan]

Attachment: iframe_sandbox_same_origin.html

When adding the allow-same-origin keyword to a sandboxed iframe the iframe's contentDocument returns null, when in certain cases (about:srcdoc, about:blank, and same origin) it should return the actual document.

Comment 1

[Deian Stefan]

Attachment: iframe_sandbox_same_origin.html

Comment 2

[Boris Zbarsky [:bzbarsky]]

Changing the sandbox attribute will affect _future_ loads in the iframe, but does not change anything about the document already loaded in the iframe.  The sandboxing flags of a document are immutable.

So the right way to write this test is to change @sandbox, then load a new document in the iframe, then see if it picked the new sandboxing flags.  I suspect that that works just fine.

Comment 3

[Deian Stefan]

(In reply to Boris Zbarsky [:bz] (Vacation Dec 19 to Jan 1) from comment #2)
> Changing the sandbox attribute will affect _future_ loads in the iframe, but
> does not change anything about the document already loaded in the iframe. 
> The sandboxing flags of a document are immutable.

Okay. In my opinion this makes more sense than what Chrome is doing
and what I thought the spec meant.

> So the right way to write this test is to change @sandbox, then load a new
> document in the iframe, then see if it picked the new sandboxing flags.  I
> suspect that that works just fine.

Yes, you are right. That works just fine.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Er... Chrome changes sandbox flags dynamically?  Can you file a bug on them, please?

Comment 5

[Deian Stefan]

(In reply to Boris Zbarsky [:bz] (Vacation Dec 19 to Jan 1) from comment #4)
> Er... Chrome changes sandbox flags dynamically?  Can you file a bug on them,
> please?

I am mistaken (sorry, staying away from keyboard for the rest of the night): for a fully loaded document, they do _not_. It's really a concurrency issue. It seemed like the flags were dynamically changing, but that's only because the flags on the docshell (or equivalent) were set before the document finished loading.