4 ms·
That's why I'm careful not to include allow-same-origin in the sandbox attribute - without that the iframe content is treated as a separate origin from the pare
by simonw 4mo ago
That's why I'm careful not to include allow-same-origin in the sandbox attribute - without that the iframe content is treated as a separate origin from the parent.
And I serve the content in srcdoc= to ensure there's no URL a user can visit which would directly execute the content outside of that iframe sandbox.
- cxr 4mo ago> That's why I'm careful not to include allow-same-origin in the sandbox attribute It doesn't matter. I just said there is no combination of CSP or the iframe sandbox attribute that can be relied upon here.
- simonw 4mo agoIf that's true then my project is fatally flawed and I need to stop distributing it. I'm not convinced it's true - I've been thinking about this for months, and building experimental prototypes to help me get to the combination that I think makes sense. Can you describe an exploit that the combination I'm using of iframe sandbox= srcdoc= with an injected meta CSP tag doesn't handle? Would moving the untrusted content to be served from a separate domain entirely close the hole? (In case it's not clear the iframe sandbox= is the bit that's doing most of the work here - the CSP stuff is there mainly to protect against malicious apps that deliberately exfiltrate stolen private data.)
- cxr 4mo ago> Would moving the untrusted content to be served from a separate domain entirely close the hole? Yes.