22318 2013-06-10 18:02:36 +0000 Should window.close() be affected by sandboxing restrictions. 2013-06-10 18:09:29 +0000 1 1 1 Unclassified HTML WG HTML5 spec unspecified All All RESOLVED INVALID P2 normal --- 1 bobowencode dave.null mike public-html-admin public-html-wg-issue-tracking public-html-bugzilla oldest_to_newest 89002 0 1370 bobowencode 2013-06-10 18:02:36 +0000 Created attachment 1370 Test window.close() from sandbox - closeTestOpener.html starts the test. As part of discussions on bug 20939, I've been asked to raise this bug. The purpose is to look at whether window.close() should be affected by sandboxing rules. In the specification at http://www.w3.org/html/wg/drafts/html/master/browsers.html#dom-window-close, it states: "The close() method on Window objects should, if the corresponding browsing context A is script-closable and the browsing context of the script that invokes the method is allowed to navigate the browsing context A, close the browsing context A." The "allowed to navigate" rules at http://www.w3.org/html/wg/drafts/html/master/browsers.html#allowed-to-navigate, don't include the sandboxing rules, but sandboxing could actually affect whether navigation takes place. So the question is, if navigation of a browsing context is blocked by sandboxing rules, should window.close() also be blocked. I believe it should, as (for example) it seems wrong that a sandboxed browsing context is not allowed to navigate top, but is allowed to close it. I did a quick test to see what happens in a sandbox with allow-scripts, but not allow-top-navigation. closeTestOpener.html starts the test. (This test was done in early May, I'm sorry I don't have the versions that were used.) Firefox, IE10, Chrome and Opera all seem to block the direct navigation of top with window.open(..., "_top"). Only Chrome stops the window.top.close(). It gives the same error as for the navigation, which complains that you are trying to navigate top without allow-top-navigation. As I have said, Chrome's behaviour seems correct to me. Thanks, Bob 89003 1 bobowencode 2013-06-10 18:09:29 +0000 Sorry, raised against wrong product. 1370 2013-06-10 18:02:36 +0000 2013-06-10 18:02:36 +0000 Test window.close() from sandbox - closeTestOpener.html starts the test. closeTest.zip application/x-zip-compressed 1286 bobowencode UEsDBBQAAAAAAEyXykIAAAAAAAAAAAAAAAAKAAAAY2xvc2VUZXN0L1BLAwQUAAAACACilspCLdJX GxABAABlAgAAHgAAAGNsb3NlVGVzdC9jbG9zZVRlc3RJZnJhbWUuaHRtbJ1SPU/DMBDdkfgPx02J gGZFJekSKjHwNWRhQo7jNlYTO3IuVBHiv3NOQpFSCVX14Hune/f8fHZ89fCaZu9va3jMnp9Wlxdx SXU1RCUKjgBxrUiALIVrFSXY0eb2Dj0jmigMW+l0QwN90xlJ2hpwnXkRn3orSGWqpSCEL67zItcP cFh7bQq7X9hGmQBFbjta5pUwO7wB/CDbYHg/Ur9BCpIlBMq58K9fVMpRgGvnrPPK2myBLJjpZMbN EhCugdsOUhz8NrebVrY9wStLLqSnBud5873/G4ujw0A5yW3Rjy+Rd0RslfpGJTgmCNbISstdgkcD x1XqK1Cr+UjiaOw+UdYP5kjz9ypzQYZseADTX/oBUEsDBBQAAAAIAGKWykJviRvypQAAAPUAAAAe AAAAY2xvc2VUZXN0L2Nsb3NlVGVzdE9wZW5lci5odG1sbY89C8IwEIZ3wf9wZmoH7SqYdlFBQdGh II4xSWkhzYUmpYj4303S6uQt9/Xy3Ht0sbtsy/t1D4fyfCrmM1q7VsUsmfAZgLbSMeA166x0Oeld tVyToMgmiS8t7xrjorzqNXcNahBYSuuSFF5+7GNotMBhhUbqhHCFVob9bZyGqyTdBOU7oH9A3zxQ PAG1QiZy8qWS0ZspjhCI8A9IMxN9BkAspt8+UEsDBBQAAAAIALiWykKv24vNswAAAAMBAAAeAAAA Y2xvc2VUZXN0L2Nsb3NlVGVzdFdpbmRvdy5odG1sXY89C8IwEIZ3wf9w3tKptghCh6QgKigoOnRx TJvUFPpFc1L996ZJXVzuA573vffY6nDbZ4/7EU7Z9ZIuF0xTU7uuhLQdgDWKBBRaDEYRxxeVYYIT Ec2IHfNOfjzcpzswopV591YSqnIQjYKxIg2BqOtuDE0xVD2ZgEW9V8xMawtH0srv+HPhfzowQ8Gx qDujMmXo7Oj1lBrBip/aZkxitDclaY6bbYwpi7ypSz1ldcP86RdQSwECPwAUAAAAAABMl8pCAAAA AAAAAAAAAAAACgAkAAAAAAAAABAAAAAAAAAAY2xvc2VUZXN0LwoAIAAAAAAAAQAYAG/QthkEZs4B b9C2GQRmzgGZ1eMcv0nOAVBLAQI/ABQAAAAIAKKWykIt0lcbEAEAAGUCAAAeACQAAAAAAAAAIAAA ACgAAABjbG9zZVRlc3QvY2xvc2VUZXN0SWZyYW1lLmh0bWwKACAAAAAAAAEAGAA/DtpaA2bOAT8O 2loDZs4Bg821o/NIzgFQSwECPwAUAAAACABilspCb4kb8qUAAAD1AAAAHgAkAAAAAAAAACAAAAB0 AQAAY2xvc2VUZXN0L2Nsb3NlVGVzdE9wZW5lci5odG1sCgAgAAAAAAABABgARn++EgNmzgHsHLwS A2bOAZznds30SM4BUEsBAj8AFAAAAAgAuJbKQq/bi82zAAAAAwEAAB4AJAAAAAAAAAAgAAAAVQIA AGNsb3NlVGVzdC9jbG9zZVRlc3RXaW5kb3cuaHRtbAoAIAAAAAAAAQAYAPTZ2nQDZs4B9NnadANm zgEMgiXV80jOAVBLBQYAAAAABAAEAKwBAABEAwAAAAA=