104363 2012-12-07 04:27:14 -0800 fast/frames/sandboxed-iframe-scripting.html contains very misleading comments. 2012-12-07 10:50:47 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mkwst mkwst abarth jochen webkit.review.bot oldest_to_newest 785801 0 mkwst 2012-12-07 04:27:14 -0800 http://trac.webkit.org/browser/trunk/LayoutTests/fast/frames/sandboxed-iframe-scripting.html claims to verify that "removing the sandbox='allow-scripts' attribute at runtime prevents new scripts from launching, but existing ones keep running.". It does not verify this. Not only does it not verify this, it shouldn't verify this, as the spec states: "These flags only take effect when the nested browsing context of the iframe is navigated. Removing them, or removing the entire sandbox attribute, has no effect on an already-loaded page." I'm trying to add console warnings for blocked JavaScript, and this case confused me for longer than I care to admit in a public forum. :) 785802 1 mkwst 2012-12-07 04:33:45 -0800 (In reply to comment #0) > Not only does it not verify this, it shouldn't verify this, as the spec states: "These flags only take effect when the nested browsing context of the iframe is navigated. Removing them, or removing the entire sandbox attribute, has no effect on an already-loaded page." http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox In short, we're doing the right thing, but the comments make it sound like the wrong thing. I'll put up a patch in a moment to clear up the comments. :) 785803 2 178197 mkwst 2012-12-07 04:39:06 -0800 Created attachment 178197 Patch 785804 3 mkwst 2012-12-07 04:40:04 -0800 Hey Jochen, would you be comfortable reviewing this change? 785975 4 178197 mkwst 2012-12-07 10:45:41 -0800 Comment on attachment 178197 Patch Thanks, Darin. 785978 5 178197 webkit.review.bot 2012-12-07 10:50:44 -0800 Comment on attachment 178197 Patch Clearing flags on attachment: 178197 Committed r136963: <http://trac.webkit.org/changeset/136963> 785979 6 webkit.review.bot 2012-12-07 10:50:47 -0800 All reviewed patches have been landed. Closing bug. 178197 2012-12-07 04:39:06 -0800 2012-12-07 10:50:44 -0800 Patch bug-104363-20121207133629.patch text/plain 4437 mkwst U3VidmVyc2lvbiBSZXZpc2lvbjogMTM2ODE5CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFu Z2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggMmFhNzFiOGY5NTUyMGY4MzczNGU0 YTg3YTA3ZDA3NGI4NmVkZGRmYi4uM2VkMjY1NmNlODJjNTU5NzYzMzY4YTMyYWI2M2U2NjZjYjM5 ZjdmOCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3Rz L0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDEyLTEyLTA3ICBNaWtlIFdlc3QgIDxta3dz dEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgZmFzdC9mcmFtZXMvc2FuZGJveGVkLWlmcmFtZS1z Y3JpcHRpbmcuaHRtbCBjb250YWlucyB2ZXJ5IG1pc2xlYWRpbmcgY29tbWVudHMuCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDQzNjMKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGUgY29tbWVudHMgaW4g dGhpcyB0ZXN0IGRlc2NyaWJlIGEgc3RhdGUgdGhhdCBpcyBpbiBmYWN0IHRoZSBvcHBvc2l0ZQor ICAgICAgICBvZiB3aGF0J3MgYmVpbmcgdGVzdGVkLiBUaGF0IGNvbmZ1c2VkIG1lLiBUaGlzIHBh dGNoIGNvcnJlY3RzIHRoZQorICAgICAgICBjb21tZW50cyB0byBtYWtlIGl0IGNsZWFyIHRoYXQg YWRkaW5nIGEgc2FuZGJveCBhdHRyaWJ1dGUgYXQgcnVudGltZSBoYXMKKyAgICAgICAgbm8gZWZm ZWN0IG9uIHRoZSBmcmFtZTsgdGhlIHNhbmRib3hpbmcgZmxhZ3MgYXJlIHNldCB3aGVuIHRoZSBu ZXN0ZWQKKyAgICAgICAgYnJvd3NpbmcgY29udGV4dCBpcyBfbmF2aWdhdGVkXywgbm90IHdoZW4g dGhlIGF0dHJpYnV0ZSBjaGFuZ2VzIHZhbHVlLgorCisgICAgICAgIFNwZWM6IGh0dHA6Ly93d3cu d2hhdHdnLm9yZy9zcGVjcy93ZWItYXBwcy9jdXJyZW50LXdvcmsvbXVsdGlwYWdlL3RoZS1pZnJh bWUtZWxlbWVudC5odG1sI2F0dHItaWZyYW1lLXNhbmRib3gKKworICAgICAgICAqIGZhc3QvZnJh bWVzL3Jlc291cmNlcy9zYW5kYm94ZWQtaWZyYW1lLXNjcmlwdC1keW5hbWljLmh0bWw6CisgICAg ICAgICogZmFzdC9mcmFtZXMvc2FuZGJveGVkLWlmcmFtZS1zY3JpcHRpbmctZXhwZWN0ZWQudHh0 OgorICAgICAgICAqIGZhc3QvZnJhbWVzL3NhbmRib3hlZC1pZnJhbWUtc2NyaXB0aW5nLmh0bWw6 CisKIDIwMTItMTItMDYgIEhheWF0byBJdG8gIDxoYXlhdG9AY2hyb21pdW0ub3JnPgogCiAgICAg ICAgIEV2ZW50J3MgcmVsYXRlZFRhcmdldCByZS10YXJnZXRpbmcgZG9lcyBub3Qgb2NjdXIgZm9y IG1hbnVhbGx5IGZpcmVkIG1vdXNlIGV2ZW50cyBjcmVhdGVkIGJ5IGV2ZW50LmluaXRNb3VzZUV2 ZW50KCkuCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9yZXNvdXJjZXMvc2Fu ZGJveGVkLWlmcmFtZS1zY3JpcHQtZHluYW1pYy5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9mcmFt ZXMvcmVzb3VyY2VzL3NhbmRib3hlZC1pZnJhbWUtc2NyaXB0LWR5bmFtaWMuaHRtbAppbmRleCBm MTA5ZjgzNmE0NjMxNDhiMWYzMTYzYTczMDU3MjNjYTAyOGYzMjVkLi4yZmY3YWM4OTdhN2U5ZmU4 YmRlYzRiZDcxZTlkMGIyMTA3ZGIyMjIzIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9mYXN0L2Zy YW1lcy9yZXNvdXJjZXMvc2FuZGJveGVkLWlmcmFtZS1zY3JpcHQtZHluYW1pYy5odG1sCisrKyBi L0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL3Jlc291cmNlcy9zYW5kYm94ZWQtaWZyYW1lLXNjcmlw dC1keW5hbWljLmh0bWwKQEAgLTQsMTUgKzQsMTUgQEAKIAogICAgIGZyYW1lID0gd2luZG93LnRv cC5kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnZnJhbWUnKTsKIAotICAgIC8vIHNldHRpbmcgdGhl IHNhbmRib3ggZmxhZyBhdCBydW50aW1lIHNob3VsZCBub3QgY2hhbmdlIHdoZXRoZXIgc2NyaXB0 cworICAgIC8vIFNldHRpbmcgdGhlIHNhbmRib3ggZmxhZyBhdCBydW50aW1lIHNob3VsZCBub3Qg Y2hhbmdlIHdoZXRoZXIgc2NyaXB0cwogICAgIC8vIGFyZSBhbGxvd2VkIGluIHRoaXMgZG9jdW1l bnQuCiAKICAgICBmcmFtZS5zYW5kYm94ID0gJ2FsbG93LXNhbWUtb3JpZ2luJzsgICAvLyBOTyBh bGxvdy1zY3JpcHRzCiAKICAgICArK3dpbmRvdy50b3AuYWxsb3dlZEV4ZWN1dGVkOwogCi0gICAg Ly8gaG93ZXZlciwgbmV3IHNjcmlwdHMgKHN1Y2ggYXMgdGhlIG9ubG9hZCBvbmUgYmVsb3cpIHNo b3VsZAotICAgIC8vIG5vdCBydW4KKyAgICAvLyBUaGlzIG1lYW5zIHRoYXQgbmV3IHNjcmlwdHMg KHN1Y2ggYXMgdGhlIG9ubG9hZCBoYW5kbGVyIGJlbG93KSBzaG91bGQKKyAgICAvLyBjb250aW51 ZSB0byBleGVjdXRlLCBldmVuIHRob3VnaCB0aGUgZnJhbWUgbm93IGhhcyBhIHNhbmRib3ggYXR0 cmlidXRlLgogCiAgICAgZnVuY3Rpb24gb25sb2FkX2hvb2soKQogICAgIHsKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL3NhbmRib3hlZC1pZnJhbWUtc2NyaXB0aW5nLWV4cGVj dGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL3NhbmRib3hlZC1pZnJhbWUtc2NyaXB0 aW5nLWV4cGVjdGVkLnR4dAppbmRleCBmZDRkZDM5NzFhYmFmZThjY2VkNzdlMTdkYjI0ZjBmZmIy MjczMDk1Li5lY2Y5YmExYmJjZjU0NThmMmVkZjFjNWYxNzY2YzZhNDM5NTcyZTQ3IDEwMDY0NAot LS0gYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9zYW5kYm94ZWQtaWZyYW1lLXNjcmlwdGluZy1l eHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9mcmFtZXMvc2FuZGJveGVkLWlmcmFt ZS1zY3JpcHRpbmctZXhwZWN0ZWQudHh0CkBAIC0xLDUgKzEsNSBAQAogQUxFUlQ6IFBBU1M6IEV4 ZWN1dGVkIHNjcmlwdCBpbiBkYXRhIFVSTAotVmVyaWZ5IHRoYXQgc2FuZGJveGVkIGZyYW1lcyB3 aXRoIHNhbmRib3g9ImFsbG93LXNjcmlwdHMiIGNhbiBleGVjdXRlIHNjcmlwdHMsIGJ1dCBvdGhl ciBzYW5kYm94ZWQgZnJhbWVzIGNhbm5vdC4gQWxzbyB2ZXJpZnkgdGhhdCByZW1vdmluZyB0aGUg c2FuZGJveD0iYWxsb3ctc2NyaXB0cyIgYXR0cmlidXRlIGF0IHJ1bnRpbWUgcHJldmVudHMgbmV3 IHNjcmlwdHMgZnJvbSBsYXVuY2hpbmcsIGJ1dCBleGlzdGluZyBvbmVzIGtlZXAgcnVubmluZy4K K1ZlcmlmeSB0aGF0IHNhbmRib3hlZCBmcmFtZXMgd2l0aCBzYW5kYm94PSJhbGxvdy1zY3JpcHRz IiBjYW4gZXhlY3V0ZSBzY3JpcHRzLCBidXQgb3RoZXIgc2FuZGJveGVkIGZyYW1lcyBjYW5ub3Qu IEFsc28gdmVyaWZ5IHRoYXQgYWRkaW5nIGEgc2FuZGJveCBhdHRyaWJ1dGUgYXQgcnVudGltZSBk b2VzIG5vdCBlZmZlY3QgdGhlIGN1cnJlbnQgc3RhdGUgb2YgdGhlIGlmcmFtZS4KIAogT24gc3Vj Y2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQg YnkgIlRFU1QgQ09NUExFVEUiLgogCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1l cy9zYW5kYm94ZWQtaWZyYW1lLXNjcmlwdGluZy5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9mcmFt ZXMvc2FuZGJveGVkLWlmcmFtZS1zY3JpcHRpbmcuaHRtbAppbmRleCA2N2Y2YWU4MzQ5ZGI2ZWUx NGExNTcyNjJhYTFmYTNiMzg1MTAyMzE4Li43ZjMxMDUyNThhYWYxNWQyYTAyMjc5NTVkNTdiYjMz MTc0ZTE3ODNjIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9zYW5kYm94ZWQt aWZyYW1lLXNjcmlwdGluZy5odG1sCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL3NhbmRi b3hlZC1pZnJhbWUtc2NyaXB0aW5nLmh0bWwKQEAgLTM4LDkgKzM4LDggQEAgd2luZG93Lm9ubG9h ZCA9IGZ1bmN0aW9uKCkKIAogICAgIDxzY3JpcHQ+CiAgICAgZGVzY3JpcHRpb24oIlZlcmlmeSB0 aGF0IHNhbmRib3hlZCBmcmFtZXMgd2l0aCBzYW5kYm94PSZxdW90O2FsbG93LXNjcmlwdHMmcXVv dDsgY2FuIGV4ZWN1dGUgc2NyaXB0cywgIgotICAgICAgICAgICAgICAgICArICJidXQgb3RoZXIg c2FuZGJveGVkIGZyYW1lcyBjYW5ub3QuIEFsc28gdmVyaWZ5IHRoYXQgcmVtb3ZpbmcgdGhlICIK LSAgICAgICAgICAgICAgICAgKyAic2FuZGJveD0mcXVvdDthbGxvdy1zY3JpcHRzJnF1b3Q7IGF0 dHJpYnV0ZSBhdCBydW50aW1lIHByZXZlbnRzIG5ldyBzY3JpcHRzIGZyb20gbGF1bmNoaW5nLCAi Ci0gICAgICAgICAgICAgICAgICsgImJ1dCBleGlzdGluZyBvbmVzIGtlZXAgcnVubmluZy4iKTsK KyAgICAgICAgICAgICAgICAgKyAiYnV0IG90aGVyIHNhbmRib3hlZCBmcmFtZXMgY2Fubm90LiBB bHNvIHZlcmlmeSB0aGF0IGFkZGluZyBhIHNhbmRib3ggYXR0cmlidXRlIGF0IHJ1bnRpbWUgIgor ICAgICAgICAgICAgICAgICArICJkb2VzIG5vdCBlZmZlY3QgdGhlIGN1cnJlbnQgc3RhdGUgb2Yg dGhlIGlmcmFtZS4iKTsKICAgICA8L3NjcmlwdD4KIDwvYm9keT4KIDwvaHRtbD4K