Closed franklyn07 closed 5 months ago
CC @ArthurSonzogni
Leaving this here for anyone stumbling on the same problem. From my understanding and after experimentation, it looks like this directive with the aforementioned tokens, only apply to any nested context such as IFrames within the parent page. This means that if an embedded IFrame tries to trigger a navigation in the top parent, it will be prevented by such directives. However, the directive will not be violated if a script embedded within the parent page tries to make the page navigate elsewhere, despite the parent page being the top level context. Apparently this kind of behaviour was intended to be controlled by a now deprecated directive called navigate-to. In the absence of such directive, it is still unclear, how one can control which domains can be whitelisted for navigation, through CSP.
Hi, I have spent considerable time going through open issues and bug reports both in chrome and firefox, but none seem to address the following problem.
From documentation we get the following definition for the sandbox directive: "If the sandbox directive is present, the page is treated as though it was loaded inside of an "
The token value "allow-top-navigation" is described as "letting the resource navigate the top-level browsing context (the one named _top)", where in the absence of it, we assume that the converse applies.
Now consider a CSP header which is applied to an arbitrary page index.html. Based on the previously cited documentation, I was expecting that a restrictive directive of the form: sandbox; where the allow-top-navigation token is omitted, would prevent any redirections to any other page, even if triggered from within index.html; irrespective of whether they are triggered by a user or programmatically.
Upon testing it was noted that redirects from within the sandboxed page were still possible, despite index.html being the top level browsing context. More specifically, a couple of examples which when embedded within index.html, would redirect to another page (in this case a third party);
<a id="redirectButton" href="https://evil.com" class="button">Go to Evil</a>
<script> setTimeout(function(){ top.window.location.replace('https://evil.com/'); },1000) </script>
<script> document.getElementById('redirectButton').onclick = function() { window.location.href = 'https://evil.com/'; }; </script>
Is this intended behaviour and I am misunderstanding the sandbox directive, or is it an issue with the policy? Any help/explanation of what is happening would be greatly appreciated.