[Webkit-unassigned] [Bug 222312] New: iframe with blob url does not work with sandboxing

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=222312

            Bug ID: 222312
           Summary: iframe with blob url does not work with sandboxing
           Product: WebKit
           Version: Safari 14
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Frames
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: benjaminkindle at yahoo.com

In a site hosted with https, if an iframe is using a blob url generated from html content, and its sandbox is set to "allow-scripts", the iframe does not load the html. This works in other browsers and in Safari 13.1, but it does not work in Safari 14.0.3 (15610.4.3.1.6, 15610) or Safari Technology preview Release 120 (Safari 14.2, WebKit 15612.1.2.6).

See a reproduction here: https://stackblitz.com/edit/webkit-iframe-blob-src-bug.

It's possible that Safari is intentionally more strict about this, but I can't find any evidence that it's intentional.

This can be worked around by setting sandbox="allow-scripts allow-same-origin".

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210223/f927e08f/attachment.htm>