[whatwg] Fixing two security vulnerabilities in registerProtocolHandler

On 4/2/12 7:39 PM, Ian Hickson wrote:
>> For example, an attacker could open a window on a victim web page. The
>> victim web page then opens an<iframe>  on a content URL that triggers
>> RPH. The attacker then navigates the<iframe>  so that its
>> window.location contains a different content URL.
>
> How can the attacker navigate that iframe? Surely it would not be allowed
> to navigate it, per the "allowed to navigate" definition in HTML.

As far as I can tell UAs seem to allow walking window.frames for any 
window you have a reference to without performing any same-origin 
checks, so you can walk your way down the frame hierarchy and then set 
location.href, which is allowed cross-origin.  I don't see any sort of 
"allowed to navigate" check happening on the href set in UAs, but maybe 
I'm testing it wrong?

-Boris