IFRAME content displaying outside boundaries when transition applied (also CVE-2010-1757)
If you load http://farm.rob.sproutinc.com/webkit.problem.iframe.html in iOS 3.1.3 and earlier and click on the gray <div>, the content will jump outside of the IFRAME's bounds right when the WebKit Transition is applied. I searched high and low and found CVE-2010-1757 which fixed a security bug that now prevents this in 3.2+. But, the problem is that we are not intentionally trying to show content outside the IFRAME, we want the content to stay inside the IFRAME; we are only triggering a fade out transition. Does anyone know of a workaround that we can apply on the HTML-side to prevent this prison break from happening in 3.1.3 and earlier? (Sorry if this isn't an appropriate place to ask this question.)
WebKit CVE-ID: CVE-2010-1757 Available for: iOS 2.0 through 3.1.3 for iPhone 3G and later, iOS 2.1
through 3.1.3 for iPod touch (2nd generation) and later
Impact: Websites with embedded iframe elements may be vulnerable to user
interface spoofing
Description: Safari allows an iframe element to display content outside its
boundaries, which may lead to user interface spoofing. This issue is addressed by not allowing iframe elements to display content outside their boundaries. Credit to Wayne Pan of AdMob, Inc. for reporting this issue.
Thanks, -- Rob Barreca Director of Development Sprout, Inc. Mobile: 808.224.1905 Confidential and Proprietary Property of Sprout; Do not distribute. The information contained in this email is confidential. This information is intended for use only by the individual to whom it is addressed. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this communication and its contents is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email and attachments, and destroy all copies.
It seems adding -webkit-transform: translateZ(0px); to the <body>'s style attribute of the iframed content in order to enable hardware acceleration works around this bug in 3.1.3 and earlier. -R On Tue, Sep 7, 2010 at 2:14 PM, Rob Barreca <rob@sproutinc.com> wrote:
If you load http://farm.rob.sproutinc.com/webkit.problem.iframe.html in iOS 3.1.3 and earlier and click on the gray <div>, the content will jump outside of the IFRAME's bounds right when the WebKit Transition is applied. I searched high and low and found CVE-2010-1757 which fixed a security bug that now prevents this in 3.2+. But, the problem is that we are not intentionally trying to show content outside the IFRAME, we want the content to stay inside the IFRAME; we are only triggering a fade out transition. Does anyone know of a workaround that we can apply on the HTML-side to prevent this prison break from happening in 3.1.3 and earlier?
(Sorry if this isn't an appropriate place to ask this question.)
WebKit
CVE-ID: CVE-2010-1757
Available for: iOS 2.0 through 3.1.3 for iPhone 3G and later, iOS 2.1
through 3.1.3 for iPod touch (2nd generation) and later
Impact: Websites with embedded iframe elements may be vulnerable to user
interface spoofing
Description: Safari allows an iframe element to display content outside its
boundaries, which may lead to user interface spoofing. This issue is addressed by not allowing iframe elements to display content outside their boundaries. Credit to Wayne Pan of AdMob, Inc. for reporting this issue.
Thanks,
-- Rob Barreca Director of Development Sprout, Inc. Mobile: 808.224.1905
Confidential and Proprietary Property of Sprout; Do not distribute. The information contained in this email is confidential. This information is intended for use only by the individual to whom it is addressed. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this communication and its contents is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email and attachments, and destroy all copies.
-- Rob Barreca Director of Development Sprout, Inc. Mobile: 808.224.1905 Confidential and Proprietary Property of Sprout; Do not distribute. The information contained in this email is confidential. This information is intended for use only by the individual to whom it is addressed. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this communication and its contents is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email and attachments, and destroy all copies.
participants (1)
-
Rob Barreca