webappsec-ISSUE-56 (child src navigation): Should we restrict subsequent navigation within child-src? [CSP 1.1]

webappsec-ISSUE-56 (child src navigation): Should we restrict subsequent navigation within child-src? [CSP 1.1]

http://www.w3.org/2011/webappsec/track/issues/56

Raised by: Brad Hill
On product: CSP 1.1

We use CSP to govern creation of child browsing contexts of various types.  It makes sense to prevent inline content from creating such links, or from navigating a sub-context itself.  

Does it make sense to prevent the new context from navigating itself?  This is a bit odd, not sure what threats it protects against, and creates some information leakage risks:

http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html

Could we say that frame-src and similar govern only the initial value and parent navigation of the frame, not its own self-navigation?

Received on Tuesday, 14 January 2014 22:36:13 UTC