这是indexloc提供的服务,不要输入任何密码
Skip to content

In receiver page, sandboxing flags do not fully block top-level navigation. #434

@markafoltz

Description

@markafoltz

The steps to create a receiving browsing context set the sandboxed top-level navigation browsing context flag [1]. According to the HTML 5.1 navigation algorithm [1], this only applies when nested browsing contexts attempt to navigate their top browsing context, so it does not make sense for the original receiving browsing context (only, possibly, nested browsing contexts inside it).

We could also set the sandboxed navigation browsing context flag, which would block navigation for browsing contexts other than the receiving browsing context. But I don't see a way to block a top-level browsing context from navigating itself - at least through the sandboxing flags defined in HTML.

I would suggest removing the sandboxed top-level navigation browsing context flag and adding a normative note that the receiving user agent should block top-level navigation that is not same-document, which should cover both navigation from top-level contexts and nested contexts.

[1] https://www.w3.org/TR/html51/browsers.html#sandboxing
[2] https://www.w3.org/TR/html51/browsers.html#allowed-to-navigate

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions