Same-host <base href="..."> disallowed in sandboxed iframe with CSP base-uri 'self' |
||||
Issue descriptionChrome Version : 66.0.3359.117 OS Version: Debian Rodete URLs (if applicable) : https://jsfiddle.net/mjakfr2v/ Other browsers tested: Add OK or FAIL after other browsers where you have tested this issue: Safari: unknown Firefox: OK IE/Edge: OK What steps will reproduce the problem? <html> <body> <iframe sandbox="allow-scripts" src="https://policies.google.com/privacy/embedded"></iframe> </body> </html> https://policies.google.com/privacy/embedded page has CSP header: content-security-policy: ... base-uri 'self'; ... https://jsfiddle.net/mjakfr2v/ What is the expected result? No error, base URL of the iframe set properly to https://policies.google.com What happens instead of that? Refused to set the document's base URI to 'https://policies.google.com/' because it violates the following Content Security Policy directive: "base-uri 'self'". Base URL remains at https://policies.google.com/privacy UserAgentString: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
,
Apr 19 2018
Able to reproduce this issue on reported version 66.0.3359.117 and latest canary 68.0.3400.0 using Windows 10, Mac 10.13.3 and Ubuntu 14.04 using JSFiddle given in comment#0. This issue is seen from M-60. Hence considering this issue as Non-Regression and marking as Untriaged. Thanks!
,
Apr 19 2018
I can repro this bug with and without Site Isolation enabled, so I don't think that's the cause. mkwst@ or iclelland@, would you be able to take a look from the CSP / iframe sandbox perspective?
,
Apr 23 2018
Chrome certainly appears to be violating the spec here: Where https://w3c.github.io/webappsec-csp/#allow-base-for-document says that the base uri is to be compared against "document’s fallback base URL’s origin", Chrome is actually comparing it against the document's origin (which is opaque in this case) Re: #4, Was this correct before M60, or has this bug always been present in the code?
,
Apr 24 2018
|
||||
►
Sign in to add a comment |
||||
Comment 1 by vamshi.kommuri@chromium.org
, Apr 18 2018