[Webkit-unassigned] [Bug 38424] add support for text/html-sandboxed on sandboxed iframes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=38424





--- Comment #4 from eduardo <evn at google.com>  2010-08-18 09:49:40 PST ---
(In reply to comment #2)
> Created an attachment (id=64691)
 --> (https://bugs.webkit.org/attachment.cgi?id=64691) [details]
> Proposed patch
> 
> This implementation is based on the current WhatWG specifications:
> 
>   http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html
>   http://www.whatwg.org/specs/web-apps/current-work/multipage/iana.html#text/html-sandboxed
> 
> Content of type 'text/html-sandboxed' is rendered only if the loading
> frame is sandboxed wrt. origin.  (Without the patch, Safari renders
> 'text/html-sandboxed' like 'text/plain,' while Chrome offers to save
> the file instead.)

I don't know if that is on the spec, but if it isn't it should be.. 

> We've made a few assumptions in this patch, and we invite you to
> challenge them:
> 
> * We interpret the spec to imply that the sandbox attribute must be
>   explicitly assigned to the iframe element, rather than implicitly
>   inferred from the Content-type response header of the document in
>   the iframe.

As said before, if it's not in the spec I think it should be

> * We interpret the spec to imply that the loading iframe only needs to
>   have the 'SandboxOrigin' flag set.  This means that a
>   'text/html-sandboxed' document can still run scripts, submit forms,
>   and so on.

That's correct I think.

> * We suspect that browsers may want to provide more detailed feedback
>   to the user when 'text/html-sandboxed' content is suppressed
>   (perhaps by adding callbacks in FrameLoaderClient).  However, we
>   have currently not anticipated the design decisions for such
>   feedback, since we assume browser vendors know this area better.

cool.


One more thing I am not sure if it's even possible. Could it be possible that if a plugin requests a document with text/html-sandboxed to return access denied?

Greetings

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.