execCommand('print') lets pages bypass sandboxed iframe blocking of window.print
Reported by
bzbar...@mit.edu,
Oct 25 2016
|
||||
Issue description
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Firefox/52.0
Example URL:
Steps to reproduce the problem:
1. Load the following page:
<iframe srcdoc="<input type='button' value='click me to try to print'
onclick='document.execCommand("print", false, null);'>"
sandbox="allow-scripts"></iframe>
2. Click the button in the iframe.
What is the expected behavior?
The print dialog is blocked just like it would be for window.print(), because allow-modals is not specified in the sandbox flags.
What went wrong?
There was a modal print dialog even though the subframe was explicitly sandboxed without allow-modals.
Does it occur on multiple sites: Yes
Is it a problem with a plugin? No
Did this work before? No
Does this work in other browsers? N/A
Chrome version: 56.0.2897.0 (Official Build) dev (64-bit) Channel: dev
OS Version: OS X 10.10
Flash Version:
,
Oct 25 2016
,
Oct 26 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/6a616686e564d5cac7d25b61070b5031a818df8d commit 6a616686e564d5cac7d25b61070b5031a818df8d Author: mkwst <mkwst@chromium.org> Date: Wed Oct 26 10:47:55 2016 Sandbox should prevent 'execCommand("print", ...)'. Unless 'allow-modals' is present, 'sandbox' should prevent modal dialogs, including the print dialog popped up from 'execCommand("print", ...)'. The existing code doesn't handle this case; this patch moves the sandbox check up to 'ChromeClient::print()', which handles both 'print()' and 'execCommand("print", ...'. BUG=658985 R=jochen@chromium.org Review-Url: https://codereview.chromium.org/2448833003 Cr-Commit-Position: refs/heads/master@{#427664} [modify] https://crrev.com/6a616686e564d5cac7d25b61070b5031a818df8d/third_party/WebKit/LayoutTests/http/tests/security/sandbox-iframe-blocks-modals.php [modify] https://crrev.com/6a616686e564d5cac7d25b61070b5031a818df8d/third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp [modify] https://crrev.com/6a616686e564d5cac7d25b61070b5031a818df8d/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp [modify] https://crrev.com/6a616686e564d5cac7d25b61070b5031a818df8d/third_party/WebKit/Source/core/page/ChromeClient.cpp [modify] https://crrev.com/6a616686e564d5cac7d25b61070b5031a818df8d/third_party/WebKit/Source/core/page/ChromeClient.h
,
Jul 25 2017
I guess this bug can be closed after https://codereview.chromium.org/2448833003 ?
,
Oct 4 2017
,
Nov 13 2017
|
||||
►
Sign in to add a comment |
||||
Comment 1 by mkwst@chromium.org
, Oct 25 2016Status: Started (was: Unconfirmed)