Issue implementing the CSP directive frame-src
Reported by
davidf...@gmail.com,
Nov 14 2016
|
||||||
Issue descriptionChrome Version : 54.0.2840.99 m URLs (if applicable) : https://www.economical.com/en/careers/career-opportunities Other browsers tested: Add OK or FAIL, along with the version, after other browsers where you have tested this issue: Safari: OK Firefox: OK IE: OK What steps will reproduce the problem? (1) Visit https://www.economical.com/en/careers/career-opportunities (2) Click Search Button in the iframe (3) Click on any search result (4) Click the Send to a Friend button in the bottom right corner (5) Click the Send button What is the expected result? Clicking the Send button should open a new email in the users preferred client What happens instead? Nothing. The console says that the button click violates the CSP directive frame-src. However, this has been set to * so every src should be allowed Please provide any additional information below. Attach a screenshot if possible. In version Version 53.0.2785.143 m - Works of Chrome this issue did not arise so this must have been something introduced recently We have also implemented the child-src directive and set it to * but this does not work either
,
Nov 18 2016
,
Nov 22 2016
Any update on this issue?
,
Feb 23 2017
I see. We're treating `mailto:` as a navigation, and disallowing it because it doesn't match the policy (and isn't a standard scheme so it doesn't match `*`). For better or worse, even if you'd fixed the `frame-src` bit, it still wouldn't have worked, because we're also blocking it as mixed content. :(
,
Feb 24 2017
1. I overstated the mixed content impact; we treat it as passive mixed content. The request isn't blocked, but it degrades the security UX of the browser. In general, I think that's a good idea for non-webby schemes that launch native applications. That kind of communication is potentially dangerous, and marking it as such seems reasonable. 2. `mailto:` is specced as a navigation, and implemented as such in browsers. I'm torn as to whether we should special-case it as part of `*` in CSP. On the one hand, I think it was probably a mistake to limit `*` to webby schemes. On the other, `mailto:` is baked-into the platform in a way that other custom schemes aren't. So... I'll start a spec discussion.
,
Feb 24 2017
I fixed this issue on my side by adding mailto: to the default-src
,
Feb 24 2017
I think that's a reasonable solution (and I apologize that it took me so long to see this). I also think that, at a minimum, we should improve Chrome's error message so that the scope of `*` is clear, because it isn't at all today. :(
,
Feb 24 2017
Sounds good to me
,
Nov 10 2017
,
Feb 18 2018
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by krajshree@chromium.org
, Nov 15 2016Labels: -Type-Bug -Pri-3 M-56 OS-Windows Pri-1 Type-Bug-Regression
Status: Untriaged (was: Unconfirmed)