Confirmed users
197
edits
Features/Platform/Iframe Sandbox: Difference between revisions
Features/Platform/Iframe Sandbox (view source)
Revision as of 18:39, 4 November 2011
, 4 November 2011no edit summary
No edit summary |
No edit summary |
||
| Line 35: | Line 35: | ||
** SHentry will also need the same 'force owner' flag for when the IFRAME is loaded from session history. | ** SHentry will also need the same 'force owner' flag for when the IFRAME is loaded from session history. | ||
** The nsFrameLoader will check if its owner content has the sandbox attribute set and is an nsHTMLIFrameElement to determine whether to sandbox the frame being loaded (again, if the allow-same-domain modifier isn't present in the sandbox attribute) | ** The nsFrameLoader will check if its owner content has the sandbox attribute set and is an nsHTMLIFrameElement to determine whether to sandbox the frame being loaded (again, if the allow-same-domain modifier isn't present in the sandbox attribute) | ||
* when we support | * when we support the CSP sandbox directive, similar logic to that in nsFrameLoader will need to be implemented for the loaders for other CSP-protectable resources | ||
* for CSP sandbox, the flags will only be stored on the document itself - when content is navigated to, the CSP sandbox flags won't be persisted (unless the new content also specifies a CSP sandbox directive) | |||
* the HTML5 spec provides examples of how to apply flags with nested IFRAMEs, abarth has proposed that if both CSP and IFRAME sandbox can apply to content, the algorithm used in these example should be used to merge the policies which sounds reasonable | |||
|Feature security review=This feature will likely need a full security review from the secteam. | |Feature security review=This feature will likely need a full security review from the secteam. | ||
|Feature qa review=We will need a test suite for this feature. Microsoft has released test cases for sandboxing, I'm not sure of their licensing status currently. We will definitely want to compare our implementation to other browsers' implementation for consistency etc. and likely address inconsistencies via suggested modifications to the HTML5 spec. | |Feature qa review=We will need a test suite for this feature. Microsoft has released test cases for sandboxing, I'm not sure of their licensing status currently. We will definitely want to compare our implementation to other browsers' implementation for consistency etc. and likely address inconsistencies via suggested modifications to the HTML5 spec. | ||