Bug 233633 - Enforce COOP, even when COOP+sandbox leads to an error page.
Summary: Enforce COOP, even when COOP+sandbox leads to an error page.
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: Safari 15
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-30 05:23 PST by ahemery
Modified: 2021-12-07 05:24 PST (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description ahemery 2021-11-30 05:23:47 PST
As discussed in https://github.com/whatwg/html/issues/7345, an opener that remains on a popup that error'd because of COOP+sandbox can lead to guessing URLs cross-origin using history length.

Instead, the spec changes in https://github.com/whatwg/html/pull/7364 to enforce COOP, even when we'll fail afterwards, severing the opener.
Comment 1 Radar WebKit Bug Importer 2021-12-07 05:24:19 PST
<rdar://problem/86152095>