Google Git
Sign in
chromium / chromium / src / 24134160cb7f395e2d82ddecdfe7ac0659c9477c
commit24134160cb7f395e2d82ddecdfe7ac0659c9477c[log] [tgz]
authorMike West <mkwst@chromium.org>Sat Nov 16 18:53:06 2019
committerCommit Bot <commit-bot@chromium.org>Sat Nov 16 18:53:06 2019
tree4fe020f224c0acc3093ee0a09b68eabc32769477
parentcf9e868d8e3bdad47f36c6061433e6052029ca5b [diff]
Prevent sandboxed frames from navigating to `javascript:`.

Frames with the `allow-popup` and `allow-popup-to-escape-sandbox` flags
can cause JavaScript execution in their origin by navigating to a
`javascript:` URL via `target=_blank` or similar. This is technically
correct, but surprising.

https://github.com/whatwg/html/pull/5083 aims to tighten that check to
match developers' expectations that `javascript:` URLs controlled by a
page that's been sandboxed away from script will not execute.

Bug: 1014371
Change-Id: I3b5fa676e73cbf78485b85ce2593284bce2e68cc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1916467
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#716035}
4 files changed
tree: 4fe020f224c0acc3093ee0a09b68eabc32769477
  1. android_webview/
  2. apps/
  3. ash/
  4. base/
  5. build/
  6. build_overrides/
  7. buildtools/
  8. cc/
  9. chrome/
  10. chromecast/
  11. chromeos/
  12. cloud_print/
  13. components/
  14. content/
  15. courgette/
  16. crypto/
  17. dbus/
  18. device/
  19. docs/
  20. extensions/
  21. fuchsia/
  22. gin/
  23. google_apis/
  24. google_update/
  25. gpu/
  26. headless/
  27. infra/
  28. ios/
  29. ipc/
  30. jingle/
  31. media/
  32. mojo/
  33. native_client_sdk/
  34. net/
  35. pdf/
  36. ppapi/
  37. printing/
  38. remoting/
  39. rlz/
  40. sandbox/
  41. services/
  42. skia/
  43. sql/
  44. storage/
  45. styleguide/
  46. testing/
  47. third_party/
  48. tools/
  49. ui/
  50. url/
  51. weblayer/
  52. .clang-format
  53. .clang-tidy
  54. .eslintrc.js
  55. .git-blame-ignore-revs
  56. .gitattributes
  57. .gitignore
  58. .gn
  59. .vpython
  60. .vpython3
  61. AUTHORS
  62. BUILD.gn
  63. CODE_OF_CONDUCT.md
  64. codereview.settings
  65. DEPS
  66. ENG_REVIEW_OWNERS
  67. LICENSE
  68. LICENSE.chromium_os
  69. OWNERS
  70. PRESUBMIT.py
  71. PRESUBMIT_test.py
  72. PRESUBMIT_test_mocks.py
  73. README.md
  74. WATCHLISTS
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure .