search

WICG / fenced-frame

Proposal for a strong boundary between a page and its embedded content
https://wicg.github.io/fenced-frame/
Other
128 stars 32 forks source link

[Spec] window.top can reach past a fenced frame boundary. #195

Open blu25 opened 1 month ago

blu25 commented 1 month ago

The definition of top-level traversable was modified to always get the unfenced top-level traversable. That is, calling this algorithm from within a fenced frame tree will break past the fenced frame boundary and get the outermost traversable instead.

This change has the side effect of breaking the intended fenced functionality of window.top. That algorithm returns the active WindowProxy of the top-level traversable. However, since that algorithm is unfenced, window.top is now able to reach past a fenced frame boundary and get a frame outside of a fenced frame tree, which is something we do not want the web platform to be able to do.

To fix this, we should:

  1. Introduce fenced/unfenced variants of top-level traversable. (we already have an unfenced variant in the form of traversable navigable)
  2. Have the window.top algorithm call the traversable navigable algorithm, essentially making it fenced.
  3. Audit other instances where top-level traversable is called to see if it should be fenced or not, and fix those as well if necessary.
  4. Based on the audit, determine if top-level traversable should be fenced or unfenced by default.
domfarolino commented 1 week ago

Isn't https://html.spec.whatwg.org/multipage/document-sequences.html#nav-traversable just the "fenced" version of "top-level traversable"? Also, I am pretty sure https://docs.google.com/spreadsheets/d/1p7_LtfkB1BAFx_Iu_vQ9J0zLHgd2SaC5ih4ANfhYp0E/edit?gid=533819146#gid=533819146&range=B338 should be the audit you're referencing. Maybe it is triaged wrong though, or we just didn't get to it.

blu25 commented 2 days ago

Isn't https://html.spec.whatwg.org/multipage/document-sequences.html#nav-traversable just the "fenced" version of "top-level traversable"?

Actually yes. I think I was thinking that "traversable navigable" and "navigable" were the same thing. In that case, then window.top can simply call traversable navigable instead of top-level traversable and it should be functionally correct and match the implementation.

Also, I am pretty sure https://docs.google.com/spreadsheets/d/1p7_LtfkB1BAFx_Iu_vQ9J0zLHgd2SaC5ih4ANfhYp0E/edit?gid=533819146#gid=533819146&range=B338 should be the audit you're referencing. Maybe it is triaged wrong though, or we just didn't get to it.

I think the triaging is correct, but because of how top-level traversable works after fenced frames, anything marked as "Expects fence" is an action required item and needs modifying to call traversable navigable and not top-level traversable.