Data URL iframes are considered secure contexts only if sandboxed

[letitz]

Hi there!

I stumbled across this initially when looking at the web platform tests for secure contexts and inheritance. The secure-contexts/basic-popup-and-iframe-tests.https.html test exhibits two failures.

The test asserts that data: iframes inherit their parent's isSecureContext bit, whether they are sandboxed or not.

The results show otherwise:

• origin-sandboxed iframes loaded from a data: URL only inherit their parent's isSecureContext bit in Safari
• non-origin-sandboxed iframes loaded from a data: URL are never secure

Indeed, it seems only Safari correctly implements the spec here. According to the spec (simplifying for clarity in this case):

• origin-sandboxed iframes check if their creation URL is potentially-trustworthy
  • data: URLs are considered potentially-trustworthy
• non-origin-sandboxed iframes check if their origin is potentially-trustworthy
  • data: URLs have opaque origins, which are not considered potentially-trustworthy

It seems strange that sandboxed iframes would be considered more secure than their non-sandboxed siblings. I think this strange state of affairs resulted from changes made for #26 and #69.

[annevk]

https://html.spec.whatwg.org/#secure-contexts supersedes the definition here.

@domenic @sideshowbarker what do you think about updating this specification? I'm happy to review patches, or submit a patch for review. I think Mike and I can land patches so even if this is effectively unowned we could still add some clarity.

[domenic]

That'd be great. I was willing to do that a while ago, but the fact that there's so many open PRs (including e.g. basic ones like #76) discouraged me.

For division of work, I'd be happy to work on updating the pointers to HTML and removing the now-redundant algorithms, but would rather someone else tackle any of the non-normative bits.

[letitz]

Oh, I see. Thanks for the pointer to the current spec in HTML, I was unaware of it...

[sideshowbarker]

@domenic @sideshowbarker what do you think about updating this specification? I'm happy to review patches, or submit a patch for review. I think Mike and I can land patches so even if this is effectively unowned we could still add some clarity.

I think updating it would be a great thing — and we have a clear way open to make it happen, so yeah, let’s move forward with it

[annevk]

Solved by #84. Thanks for the reminder that this needed cleanup @letitz!