search

WICG / fenced-frame

Proposal for a strong boundary between a page and its embedded content
https://wicg.github.io/fenced-frame/
Other
124 stars 31 forks source link

[Spec] Navigating from the default FencedFrameConfig(url) constructor doesn't install a fenced frame config. #178

Open blu25 opened 4 weeks ago

blu25 commented 4 weeks ago

The default FencedFrameConfig(url) constructor does not install a fenced frame config in the spec. FencedFrameConfig(url) puts a url into the url slot, and then we can pass in either a url or urn to the navigate algorithm. The navigate algorithm only creates a fenced frame config struct and sets the target fenced frame config if the value passed in is a urn. So, if we pass in a url to that algorithm instead, no fenced frame config will be created, and no fenced frame config instance will be created either, so the fenced frame won't have access to window.fence.

This should create a fenced frame config + install a fenced frame config instance unconditionally, but that is not what is happening currently.

blu25 commented 4 weeks ago

Note that when this is implemented, the effective sandbox flags will need to be set to the default constructor value (see kFencedFrameForcedSandboxFlags for the list of flags it will need to be set to).