RESOLVED FIXED 177671
CSP frame-ancestors works incorrectly when x-origin iframe is nested inside srcdoc iframe 
https://bugs.webkit.org/show_bug.cgi?id=177671
Summary CSP frame-ancestors works incorrectly when x-origin iframe is nested inside s...
Dima Voytenko
Reported 2017-09-29 10:49:04 PDT
The issue is demonstrated here: http://output.jsbin.com/likekal/quiet The structure of the page is: ``` https://origin1 <html> <iframe srcdoc="..."> #document <iframe src="https://origin2"></iframe> </iframe> </html> ``` In other words, origin1 embeds origin2 iframe via intermediary srcdoc (friendly) iframe. Origin2 explicitly allows embedding inside origin1 via CSP directive: ``` "Content-Security-Policy": "frame-ancestors https://origin1", ``` The demo embeds an origin2 iframe via srcdoc and via about:blank+document.write. As the result, srcdoc embedding is not allowed due to CSP error. Error in console: "Refused to load https://httpbin.org/response-headers?Content-Security-Policy=frame-ancestors%20http://output.jsbin.com because it does not appear in the frame-ancestors directive of the Content Security Policy." However, weirdly enough, the embedding via about:blank+document.write works fine. And, interestingly, location.ancestorOrigins in the x-origin iframe returns correct `[origin1, origin1]`. I believe srcdoc/x-origin should work per spec: https://w3c.github.io/webappsec-csp/#frame-ancestors-navigation-response. The srcdoc document should inherit its creator's origin, and that origin to do the comparison.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2017-10-01 11:02:48 PDT
<rdar://problem/34760668>
Frédéric Wang (:fredw)
Comment 2 2018-05-21 08:46:58 PDT
@Dima The srcdoc case seems to behave the same as src and document.write for release versions of WebKit (iOS, macOS, GTK) and I don't see any error message in the console. Can you please try again (and update the testcase if necessary)?
Dima Voytenko
Comment 3 2018-05-22 13:03:17 PDT
I'm seeing it in Safari 11.0.3 (13604.5.6). But it's fixed in release 56 (Safari 11.2, WebKit 13606.1.17.2.2). Not sure when exactly it got fixed and if there was a duplicate bug out here somewhere.
Daniel Bates
Comment 4 2018-05-22 14:47:00 PDT
This bug was fixed in <https://trac.webkit.org/changeset/227238>.
Note You need to log in before you can comment on or make changes to this bug.