33277 2010-01-06 16:55:17 -0800 HTML5 iframe sandbox bypass of window.top.location navigation via <form target="_top"> 2010-02-17 12:27:18 -0800 1 1 1 Unclassified WebKit Frames 528+ (Nightly build) PC All RESOLVED FIXED InRadar P2 Normal --- 33659 1 scarybeasts sam abarth darin eric patrik.j.persson sam oldest_to_newest 177870 0 scarybeasts 2010-01-06 16:55:17 -0800 Demo HTML follows. The sandboxed iframe should not be able to do anything to navigate the top level window, but here is a bypass: ifsandbox.html: --- <html> <body> Testing iframe sandbox attribute.... <iframe sandbox="allow-same-origin allow-forms allow-scripts" src="innerframe.html"></iframe> </body> </html> --- innerframe.html: --- <html> <body> Hello! I'm the inner frame. I will proceed to try and be irritating. <form id="f" action="http://www.google.com" method="GET" target="_top"> <input type="submit" value="Submit"/> </form> <script> // Does not work. window.top.location = 'http://www.google.com'; // Works! e = document.getElementById('f'); alert('about to submit form....'); e.submit(); </script> </body> </html> --- I haven't tried other targets (e.g. "_parent", named iframes etc). 177871 1 scarybeasts 2010-01-06 16:58:37 -0800 cc: author of iframe sandbox attribute (thanks for implementing it)! 177880 2 ddkilzer 2010-01-06 17:16:30 -0800 <rdar://problem/7517003> 177889 3 darin 2010-01-06 17:25:46 -0800 Putting this in the private security area seems unnecessarily cautious, since the sandbox attribute is brand new, hasn’t shipped yet, and isn’t in active use by websites. I think it would be OK to handle this out in the open instead. What do you think? 177890 4 46011 abarth 2010-01-06 17:26:32 -0800 Created attachment 46011 LayoutTest Here's a LayoutTest for the issue. 177891 5 scarybeasts 2010-01-06 17:27:05 -0800 Darin - agreed! 177921 6 sam 2010-01-06 19:18:41 -0800 I have a fix for this. I'll take the bug. 185307 7 scarybeasts 2010-01-27 18:20:36 -0800 Was it a simple fix or did complexities arise? 185357 8 abarth 2010-01-27 23:48:44 -0800 @Sam, I can fix this if you've got other things on your plate. 190257 9 48699 abarth 2010-02-12 23:27:23 -0800 Created attachment 48699 Patch 190258 10 abarth 2010-02-12 23:28:06 -0800 @Sam: I don't mean to step on your toes, but I'd like to get this bug fixed. Is this the same as your patch? 190300 11 48699 darin 2010-02-13 21:23:43 -0800 Comment on attachment 48699 Patch Fix is fine, r=me. No need to wait on Sam. 190386 12 48699 commit-queue 2010-02-14 22:05:34 -0800 Comment on attachment 48699 Patch Clearing flags on attachment: 48699 Committed r54764: <http://trac.webkit.org/changeset/54764> 190387 13 48699 commit-queue 2010-02-14 22:05:47 -0800 Comment on attachment 48699 Patch Rejecting patch 48699 from commit-queue. Unexpected failure when landing patch! Please file a bug against webkit-patch. Failed to run "['WebKitTools/Scripts/webkit-patch', '--status-host=webkit-commit-queue.appspot.com', 'land-attachment', '--force-clean', '--non-interactive', '--no-update', '--parent-command=commit-queue', '--build-style=both', '--quiet', '48699']" exit_code: 1 Last 500 characters of output: all.cache.d/-1555206040/mechanize-0.1.11.zip/mechanize-0.1.11/mechanize/_html.py", line 546, in __getattr__ File "/Users/eseidel/Projects/CommitQueue/WebKitTools/Scripts/webkitpy/autoinstall.cache.d/-1555206040/mechanize-0.1.11.zip/mechanize-0.1.11/mechanize/_html.py", line 559, in forms File "/Users/eseidel/Projects/CommitQueue/WebKitTools/Scripts/webkitpy/autoinstall.cache.d/-1555206040/mechanize-0.1.11.zip/mechanize-0.1.11/mechanize/_html.py", line 228, in forms mechanize._html.ParseError 190456 14 abarth 2010-02-15 07:37:59 -0800 Looks like this was landed, but CCing Eric because of the strange commit-bot error. 191150 15 eric 2010-02-17 12:27:18 -0800 That looks like bug 33659. 46011 2010-01-06 17:26:32 -0800 2010-02-12 23:27:18 -0800 LayoutTest patch text/plain 1480 abarth ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL2Zh aWwuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL2ZhaWwu aHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5lZWEyMzg0Ci0tLSAvZGV2 L251bGwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9yZXNvdXJjZXMvZmFp bC5odG1sCkBAIC0wLDAgKzEsNSBAQAorPGh0bWw+Cis8Ym9keT4KK0ZBSUwKKzwvYm9keT4KKzwv aHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3Vy Y2VzL3NhbmRib3hlZC1pZnJhbWUtZm9ybS10b3AuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkvcmVzb3VyY2VzL3NhbmRib3hlZC1pZnJhbWUtZm9ybS10b3AuaHRtbApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5jNmNiNmY2Ci0tLSAvZGV2L251bGwKKysr IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9yZXNvdXJjZXMvc2FuZGJveGVkLWlm cmFtZS1mb3JtLXRvcC5odG1sCkBAIC0wLDAgKzEsMTIgQEAKKzxodG1sPgorPGJvZHk+Cis8Zm9y bSBpZD0idGhlRm9ybSIgYWN0aW9uPSJmYWlsLmh0bWwiIG1ldGhvZD0iR0VUIiB0YXJnZXQ9Il90 b3AiPgorPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IlN1Ym1pdCIvPgorPC9mb3JtPgorPHNj cmlwdD4KK3ZhciBmID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3RoZUZvcm0nKTsKK2Yuc3Vi bWl0KCk7Cis8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KKwpkaWZmIC0tZ2l0IGEvTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9zYW5kYm94ZWQtaWZyYW1lLWZvcm0tdG9wLmh0bWwg Yi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3NhbmRib3hlZC1pZnJhbWUtZm9ybS10 b3AuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4wZGMzNjYzCi0tLSAv ZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS9zYW5kYm94ZWQt aWZyYW1lLWZvcm0tdG9wLmh0bWwKQEAgLTAsMCArMSwxNSBAQAorPGh0bWw+Cis8aGVhZD4KKzxz Y3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIHdpbmRvdy5sYXlv dXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5 PgorPHA+VGhpcyB0ZXN0cyBwYXNzZXMgaWYgdGhlIHNhbmRib3hlZCBmcmFtZSBjYW5ub3QgbmF2 aWdhdGUgdGhlIHRvcCBmcmFtZS48L3A+Cis8cD5QQVNTPC9wPgorPGlmcmFtZSBzYW5kYm94PSJh bGxvdy1mb3JtcyBhbGxvdy1zY3JpcHRzIgorICAgICAgICBzcmM9InJlc291cmNlcy9zYW5kYm94 ZWQtaWZyYW1lLWZvcm0tdG9wLmh0bWwiPgorPC9pZnJhbWU+Cis8L2JvZHk+Cis8L2h0bWw+Cg== 48699 2010-02-12 23:27:23 -0800 2010-02-14 22:05:47 -0800 Patch bug-33277-20100212232722.patch text/plain 4321 abarth ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBiZGIxYjlmLi44N2E2YTU4IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTAtMDIt MTIgIEFkYW0gQmFydGggIDxhYmFydGhAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBIVE1MNSBpZnJhbWUgc2FuZGJveCBieXBhc3Mg b2Ygd2luZG93LnRvcC5sb2NhdGlvbiBuYXZpZ2F0aW9uIHZpYSA8Zm9ybSB0YXJnZXQ9Il90b3Ai PgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MzMyNzcK KworICAgICAgICBBZGQgYSB0ZXN0IHRoYXQgX3RvcCBpcyBjb3ZlcmVkIGJ5IEBzYW5kYm94Lgor CisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS9yZXNvdXJjZXMvZmFpbC5odG1sOiBBZGRl ZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9zYW5kYm94ZWQtaWZy YW1lLWZvcm0tdG9wLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvc2VjdXJpdHkv c2FuZGJveGVkLWlmcmFtZS1mb3JtLXRvcC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAq IGh0dHAvdGVzdHMvc2VjdXJpdHkvc2FuZGJveGVkLWlmcmFtZS1mb3JtLXRvcC5odG1sOiBBZGRl ZC4KKwogMjAxMC0wMi0xMiAgT2phbiBWYWZhaSAgPG9qYW5AY2hyb21pdW0ub3JnPgogCiAgICAg ICAgIFJldmlld2VkIGJ5IERhbiBCZXJuc3RlaW4uCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9o dHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9mYWlsLmh0bWwgYi9MYXlvdXRUZXN0cy9odHRw L3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9mYWlsLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMC4uZWVhMjM4NAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL2ZhaWwuaHRtbApAQCAtMCwwICsxLDUgQEAKKzxo dG1sPgorPGJvZHk+CitGQUlMCis8L2JvZHk+Cis8L2h0bWw+CmRpZmYgLS1naXQgYS9MYXlvdXRU ZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9zYW5kYm94ZWQtaWZyYW1lLWZvcm0t dG9wLmh0bWwgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9zYW5k Ym94ZWQtaWZyYW1lLWZvcm0tdG9wLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw MDAwMC4uYzZjYjZmNgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMv c2VjdXJpdHkvcmVzb3VyY2VzL3NhbmRib3hlZC1pZnJhbWUtZm9ybS10b3AuaHRtbApAQCAtMCww ICsxLDEyIEBACis8aHRtbD4KKzxib2R5PgorPGZvcm0gaWQ9InRoZUZvcm0iIGFjdGlvbj0iZmFp bC5odG1sIiBtZXRob2Q9IkdFVCIgdGFyZ2V0PSJfdG9wIj4KKzxpbnB1dCB0eXBlPSJzdWJtaXQi IHZhbHVlPSJTdWJtaXQiLz4KKzwvZm9ybT4KKzxzY3JpcHQ+Cit2YXIgZiA9IGRvY3VtZW50Lmdl dEVsZW1lbnRCeUlkKCd0aGVGb3JtJyk7CitmLnN1Ym1pdCgpOworPC9zY3JpcHQ+Cis8L2JvZHk+ Cis8L2h0bWw+CisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkv c2FuZGJveGVkLWlmcmFtZS1mb3JtLXRvcC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9odHRw L3Rlc3RzL3NlY3VyaXR5L3NhbmRib3hlZC1pZnJhbWUtZm9ybS10b3AtZXhwZWN0ZWQudHh0Cm5l dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmQ5NDJjNzUKLS0tIC9kZXYvbnVsbAor KysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3NhbmRib3hlZC1pZnJhbWUtZm9y bS10b3AtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsNSBAQAorVGhpcyB0ZXN0cyBwYXNzZXMgaWYg dGhlIHNhbmRib3hlZCBmcmFtZSBjYW5ub3QgbmF2aWdhdGUgdGhlIHRvcCBmcmFtZS4KKworUEFT UworCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvc2FuZGJv eGVkLWlmcmFtZS1mb3JtLXRvcC5odG1sIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0 eS9zYW5kYm94ZWQtaWZyYW1lLWZvcm0tdG9wLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5k ZXggMDAwMDAwMC4uMGRjMzY2MwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0dHAv dGVzdHMvc2VjdXJpdHkvc2FuZGJveGVkLWlmcmFtZS1mb3JtLXRvcC5odG1sCkBAIC0wLDAgKzEs MTUgQEAKKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29u dHJvbGxlcikKKyAgICB3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOwor PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxwPlRoaXMgdGVzdHMgcGFzc2VzIGlmIHRoZSBz YW5kYm94ZWQgZnJhbWUgY2Fubm90IG5hdmlnYXRlIHRoZSB0b3AgZnJhbWUuPC9wPgorPHA+UEFT UzwvcD4KKzxpZnJhbWUgc2FuZGJveD0iYWxsb3ctZm9ybXMgYWxsb3ctc2NyaXB0cyIKKyAgICAg ICAgc3JjPSJyZXNvdXJjZXMvc2FuZGJveGVkLWlmcmFtZS1mb3JtLXRvcC5odG1sIj4KKzwvaWZy YW1lPgorPC9ib2R5PgorPC9odG1sPgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9X ZWJDb3JlL0NoYW5nZUxvZwppbmRleCA3NWVmMWMxLi44MjE1YjEwIDEwMDY0NAotLS0gYS9XZWJD b3JlL0NoYW5nZUxvZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisy MDEwLTAyLTEyICBBZGFtIEJhcnRoICA8YWJhcnRoQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSFRNTDUgaWZyYW1lIHNhbmRib3gg YnlwYXNzIG9mIHdpbmRvdy50b3AubG9jYXRpb24gbmF2aWdhdGlvbiB2aWEgPGZvcm0gdGFyZ2V0 PSJfdG9wIj4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTMzMjc3CisKKyAgICAgICAgc3VibWl0Rm9ybSB3YXNuJ3QgcmVzcGVjdGluZyBzaG91bGRBbGxv d05hdmlnYXRpb24uICBJbnN0ZWFkIG9mIGNhbGxpbmcKKyAgICAgICAgdGhlIHdyYXBwZXIgZnVu Y3Rpb24sIHdlIG5lZWQgdG8gY2FsbCBzaG91bGRBbGxvd05hdmlnYXRpb24gYmVjYXVzZSB3ZQor ICAgICAgICBuZWVkIHRvIGhhbmRsZSB0aGUgImZyYW1lIG5vdCBmb3VuZCIgY2FzZSBkaWZmZXJl bnRseSB0aGFuIHRoZQorICAgICAgICAibmF2aWdhdGlvbiBkZW5pZWQiIGNhc2UuCisKKyAgICAg ICAgVGVzdDogaHR0cC90ZXN0cy9zZWN1cml0eS9zYW5kYm94ZWQtaWZyYW1lLWZvcm0tdG9wLmh0 bWwKKworICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpGcmFtZUxvYWRlcjo6c3VibWl0Rm9ybSk6CisKIDIwMTAtMDEtMDUgIE9qYW4gVmFmYWkgIDxv amFuQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBEYW4gQmVybnN0ZWluLgpk aWZmIC0tZ2l0IGEvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwIGIvV2ViQ29yZS9sb2Fk ZXIvRnJhbWVMb2FkZXIuY3BwCmluZGV4IGEyMWZmOTMuLjQ3ZjMyYzkgMTAwNjQ0Ci0tLSBhL1dl YkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcAorKysgYi9XZWJDb3JlL2xvYWRlci9GcmFtZUxv YWRlci5jcHAKQEAgLTQ2Myw3ICs0NjMsOSBAQCB2b2lkIEZyYW1lTG9hZGVyOjpzdWJtaXRGb3Jt KGNvbnN0IGNoYXIqIGFjdGlvbiwgY29uc3QgU3RyaW5nJiB1cmwsIFBhc3NSZWZQdHI8RgogICAg IEZyYW1lTG9hZFJlcXVlc3QgZnJhbWVSZXF1ZXN0OwogCiAgICAgU3RyaW5nIHRhcmdldE9yQmFz ZVRhcmdldCA9IHRhcmdldC5pc0VtcHR5KCkgPyBtX2ZyYW1lLT5kb2N1bWVudCgpLT5iYXNlVGFy Z2V0KCkgOiB0YXJnZXQ7Ci0gICAgRnJhbWUqIHRhcmdldEZyYW1lID0gZmluZEZyYW1lRm9yTmF2 aWdhdGlvbih0YXJnZXRPckJhc2VUYXJnZXQpOworICAgIEZyYW1lKiB0YXJnZXRGcmFtZSA9IG1f ZnJhbWUtPnRyZWUoKS0+ZmluZCh0YXJnZXRPckJhc2VUYXJnZXQpOworICAgIGlmICghc2hvdWxk QWxsb3dOYXZpZ2F0aW9uKHRhcmdldEZyYW1lKSkKKyAgICAgICAgcmV0dXJuOwogICAgIGlmICgh dGFyZ2V0RnJhbWUpIHsKICAgICAgICAgdGFyZ2V0RnJhbWUgPSBtX2ZyYW1lOwogICAgICAgICBm cmFtZVJlcXVlc3Quc2V0RnJhbWVOYW1lKHRhcmdldE9yQmFzZVRhcmdldCk7Cg==