Open Bug 1600310 Opened 5 years ago Updated 2 years ago

Write CSP frame-ancestor test for about:blank

Categories

(Core :: DOM: Security, task, P3)

Product:
Core
Component:
DOM: Security
Type:
task

Tracking

()

People

(Reporter: ckerschb, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [domsecurity-backlog1])

The test setup should be like that

  • Top-level page hosts a CSP with "frame-ancestors 'none'
  • Top-level page dynamically loads an iframe of about:blank and starts writing into it
  • since about: pages inherit the CSP we should ensure the frame is not blocked and we can actually write into it.

FWIW, the problem occured within Bug 1600174 and we were surprised there was no test for this scenario.

Priority: -- → P3
Whiteboard: [domsecurity-backlog1]
Severity: normal → S3
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.