CSP shouldn't block about:blank for iframes Requested by abarth on #webkit.
Created attachment 140115 [details] Patch
It might be preferable to check that the URL is, in fact, `about:blank`, rather than allowing anything under `about:`. I know Chromium redirects to `chrome://`, and Safari doesn't do anything dangerous, but perhaps some other port exposes something interesting under `about:*`?
WebKit treats all "about" URLs as about:blank. The redirect you see in Chrome takes place before the URL gets to WebKit. :)
Comment on attachment 140115 [details] Patch about:banana!
Comment on attachment 140115 [details] Patch Rejecting attachment 140115 [details] from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 Last 500 characters of output: git/webkit-commit-queue/Source/WebKit/chromium/ui --revision 134581 --non-interactive --force --accept theirs-conflict --ignore-externals' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium' 46>At revision 134581. ________ running '/usr/bin/python tools/clang/scripts/update.py --mac-only' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium' ________ running '/usr/bin/python gyp_webkit' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium' Updating webkit projects from gyp files... Full output: http://queues.webkit.org/results/12620267
Comment on attachment 140115 [details] Patch Clearing flags on attachment: 140115 Committed r116052: <http://trac.webkit.org/changeset/116052>
All reviewed patches have been landed. Closing bug.
It’d be nicer if the “blank URL protocol” was something we got from KURL.h along with blankURL() instead of being a hard-coded string "about".
I've filed https://bugs.webkit.org/show_bug.cgi?id=85641 about changing the idiom.