Skip to content

Commit 1baf9eb

Browse files
ParisMeulemanChromium LUCI CQ
ParisMeuleman
authored and
Chromium LUCI CQ
committed
Prevent Cross-Origin iframe from navigating top to a different scheme
Cross-origin iframes were prevented to navigate top with [1]. Those iframes were allowed to navigate top only to same domain (eTLD+1) following reports of adverse impact. This severely restrains the ability of said iframe to cause nuisance. It does not seem necessary however to loosen the constraint to allow different schemes, especially from https to http. As a result this CL prevents a cross-origin iframe from navigating top to the same eTLD + 1 with a different schemes if there's no user gesture. [1] WICG/interventions#16 Bug: 1151507 Fixed: 1151507 Change-Id: Ia1568175c044831594154ceea3e3aacb4e2efb2c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2756509 Commit-Queue: Nate Chapin <[email protected]> Auto-Submit: Pâris Meuleman <[email protected]> Reviewed-by: Nate Chapin <[email protected]> Cr-Commit-Position: refs/heads/master@{#863936}
1 parent 74ff411 commit 1baf9eb

4 files changed

+47
-1
lines changed

‎third_party/blink/renderer/core/frame/local_frame.cc

+3-1
Original file line numberDiff line numberDiff line change
@@ -1829,7 +1829,9 @@ static bool CanNavigateHelper(LocalFrame& initiating_frame,
18291829
String destination_domain = network_utils::GetDomainAndRegistry(
18301830
destination_url.Host(), network_utils::kIncludePrivateRegistries);
18311831
if (!target_domain.IsEmpty() && !destination_domain.IsEmpty() &&
1832-
target_domain == destination_domain) {
1832+
target_domain == destination_domain &&
1833+
target_frame.GetSecurityContext()->GetSecurityOrigin()->Protocol() ==
1834+
destination_url.Protocol()) {
18331835
return true;
18341836
}
18351837

‎third_party/blink/web_tests/http/tests/security/frameNavigation/resources/iframe-that-performs-different-scheme-same-etld-plus-one-top-navigation-without-user-gesture.html

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<html>
2+
<body>
3+
The navigation should fail. This text should be visible.
4+
<script>
5+
window.onload = function()
6+
{
7+
try {
8+
top.location = "https://127.0.0.1:8443/security/frameNavigation/resources/navigation-changed-iframe.html";
9+
top.postMessage("FAIL", "*");
10+
} catch(e) {
11+
top.postMessage("PASS", "*");
12+
}
13+
}
14+
</script>
15+
</body>
16+
</html>

‎third_party/blink/web_tests/http/tests/security/frameNavigation/xss-DENIED-different-scheme-same-etld-plus-1-top-navigation-without-user-gesture-expected.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
3+
--------
4+
Frame: '<!--framePath //<!--frame0-->-->'
5+
--------
6+
The navigation should fail. This text should be visible.

‎third_party/blink/web_tests/http/tests/security/frameNavigation/xss-DENIED-different-scheme-same-etld-plus-1-top-navigation-without-user-gesture.html

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<html>
2+
<head>
3+
<script>
4+
if (window.testRunner) {
5+
testRunner.dumpAsText();
6+
testRunner.dumpChildFrames();
7+
testRunner.setDumpConsoleMessages(false);
8+
testRunner.waitUntilDone();
9+
}
10+
11+
window.addEventListener("message", e => {
12+
if (e.data == "PASS")
13+
testRunner.notifyDone();
14+
else
15+
testRunner.testFailed("'top.location' didn't throw.");
16+
});
17+
</script>
18+
</head>
19+
<body>
20+
<iframe src="http://sub1.example.test:8000/security/frameNavigation/resources/iframe-that-performs-different-scheme-same-etld-plus-one-top-navigation-without-user-gesture.html"></iframe>
21+
</body>
22+
</html>

0 commit comments

Comments
 (0)