What is the 'self' of sandboxed page? #260

shhnjk · 2017-10-28T00:05:51Z

Following test shows that all browsers treat 'self' as url's origin for sandboxed page.

https://test.shhnjk.com/csp_sandbox.php?xss=%3Cscript%20src=/alert.js%3E%3C/script%3E%3Cimg%20src=/test.jpeg%3E&csp=allow-scripts%20allow-modals;%20default-src%20%27self%27

But the spec doesn't seem to say so.

What is the right behavior here?

shhnjk mentioned this issue Oct 31, 2017

Handling of 'self' is unclear when inheriting CSP to local scheme #248

Closed

andypaicu added this to the CSP3 CR milestone Jan 9, 2018

andypaicu mentioned this issue Nov 8, 2018

Add a self-origin member to policy to facilitate opaque origin contexts that inherit their policies #362

Merged

andypaicu closed this as completed Nov 28, 2018

hiroshige-g mentioned this issue Feb 11, 2019

policy's self-origin for CSP policies inserted by <meta> #384

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

What is the 'self' of sandboxed page? #260

What is the 'self' of sandboxed page? #260

shhnjk commented Oct 28, 2017 •

edited

What is the 'self' of sandboxed page? #260

What is the 'self' of sandboxed page? #260

Comments

shhnjk commented Oct 28, 2017 • edited

shhnjk commented Oct 28, 2017 •

edited