Bug 36732 – sandboxed iframes from same origin should not be granted notification permission of the parent frame unless allow-same-origin is specified

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Rafael Weinstein]

<iframe sandbox="allow-scripts"> from the same origin as the host page should be restricted from webkitNotifications.requestPermission(), webkitNotification.createNotification() & webkitNotification.createHTMLNotification unless allow-same-origin is specified.

The underlying issue is that isUnique() is not being observed. Note that https://bugs.webkit.org/show_bug.cgi?id=36625 changes the interface of NotificationPresenter to pass the url rather than the security origin, so clients will not longer be able to observe the bit.

Per discussion with abarth on #webkit, the preferred approach will be to have the check of isUnique() take place prior to calling into the clients NotificationPresenter.

Allow per discussion with abarth on #webkit, I set about creating an (if checked in, failing) layout test, but the notifications layout tests do not yet support granting permission via the layoutController and are disabled, so I've attached a simple html test that should be easily adapted to a layout test.

[Rafael Weinstein]

Created attachment 51866 [details]
html test

This test loads the same document twice as an iframe, once with sandbox="allow-scripts" and once with sandbox="allow-scripts allow-same-origin".

If the parent frame is granted notification permission, only the allow-same-origin iframe should report that it has been granted permission as well.

[Adam Barth]

Looking now.

[Adam Barth]

Created attachment 54978 [details]
Patch

[Adam Barth]

I don't know how to build with this feature turned on, but this is how I would fix it if I could.  I also did some misc cleanup while I was trying to understand the code.

Would someone who knows how to build/test this feature be willing to see if this code actually compiles and to write a test?  Many thanks.

[Adam Barth]

Created attachment 54979 [details]
Patch

[Mike West]

It looks like this was fixed in https://bugs.webkit.org/show_bug.cgi?id=79704

That patch didn't add a test for sandboxed frames, however. I'll put one together to close this bug out.

[Mike West]

Created attachment 180944 [details]
Patch

[Adam Barth]

Comment on attachment 180944 [details]
Patch

Thanks for the test.

[WebKit Review Bot]

Comment on attachment 180944 [details]
Patch

Clearing flags on attachment: 180944

Committed r138624: <http://trac.webkit.org/changeset/138624>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.