Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Should about:blank inherit CSP in addition to origin? #2592

Closed
bzbarsky opened this issue Apr 26, 2017 · 8 comments
Closed

Should about:blank inherit CSP in addition to origin? #2592

bzbarsky opened this issue Apr 26, 2017 · 8 comments
Labels
topic: navigation

Comments

@bzbarsky
Copy link
Contributor

Right now per spec it does not. That seems a bit odd, and a way for people to sneak things in past CSP if a page just uses a blank iframe as an extra rendering area.
@bzbarsky
Copy link
Contributor Author

//cc @mikewest

@wanderview
Copy link
Member

Also referrer-policy?

@wanderview
Copy link
Member

Also, we've said things like the service worker controller should be inherited along with the origin:

w3c/ServiceWorker#1093

@bzbarsky
Copy link
Contributor Author

So I wrote a testcase:

<!DOCTYPE html>
<meta http-equiv="Content-Security-Policy" content="img-src 'self'">
<iframe></iframe>
<script>
  const imageURL = "http://software.hixie.ch/resources/style/2010/trains.jpeg"
  function insertImage(doc) {
    var img = doc.createElement("img");
    img.src = imageURL;
    img.alt = "I am not here";
    doc.body.appendChild(img);
  }
  onload = function() {
    insertImage(document);
    insertImage(frames[0].document);
  }
</script>

and as far as I can tell, Firefox, Chrome, Safari, and Edge all apply the CSP from the parent to the subframe in this case.

@bzbarsky
Copy link
Contributor Author

I guess this is kinda handled in https://w3c.github.io/webappsec-csp/#initialize-document-csp sorta. It's weird that we do this quite differently for about:blank and srcdoc...

@annevk
Copy link
Member

annevk commented May 10, 2017

Related: #1445.

@annevk annevk mentioned this issue Apr 23, 2019
Open
@domenic domenic mentioned this issue Dec 24, 2020
Open
@domenic
Copy link
Member

domenic commented Jun 24, 2021

@antosart I imagine this is now well-specified since CSP is in the policy container. Is it well-tested as well?

@domenic domenic mentioned this issue Jun 24, 2021
Open
@antosart
Copy link
Member

Yes, it is now well-specified and fully tested (see the inheritance folder inside CSP WPTs, and in particular iframe-all-local-schemes.sub.html and window.html.

Marking as closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic: navigation
Milestone
No milestone
Development

No branches or pull requests
5 participants
@domenic @wanderview @bzbarsky @annevk @antosart