From b96aee50e137ebc4bb4af6b783b7bab83128c244 Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Mon, 10 Mar 2014 22:33:34 +0800 Subject: [PATCH 1/4] :memo: Mention that iframe is sandboxed by default. --- docs/api/browser/browser-window.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/api/browser/browser-window.md b/docs/api/browser/browser-window.md index 43ef062c3e..b2bfe83820 100644 --- a/docs/api/browser/browser-window.md +++ b/docs/api/browser/browser-window.md @@ -66,12 +66,15 @@ An example of enable node integration in iframe with `node-integration` set to ``` -And you should also notice that the iframes can have access to parent window's -javascript objects via `window.parent`, so in order to grant complete security -from iframes, you should add `sandbox` attribute to the iframes: +And in atom-shell, the security limitaion of iframe is stricter than normal +browser, by default iframe is sandboxed with all permissions except the +`allow-same-origin`, which means iframe could not access parent's js context. + +If you want to enable things like `parent.window.process.exit()` in iframe, +you should explictly set `sandbox` to `none`: ```html - + ``` ### Event: 'page-title-updated' From 31b08a3ec68bac87b93a5b46bd1fa28e3e0ef6c0 Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Mon, 10 Mar 2014 22:42:03 +0800 Subject: [PATCH 2/4] Update specs with new sandbox setting. --- spec/chromium-spec.coffee | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/spec/chromium-spec.coffee b/spec/chromium-spec.coffee index 91461a3e00..f9be63079e 100644 --- a/spec/chromium-spec.coffee +++ b/spec/chromium-spec.coffee @@ -25,12 +25,14 @@ describe 'chromium feature', -> assert.equal b.constructor.name, 'BrowserWindow' b.destroy() - describe 'iframe with sandbox attribute', -> - it 'can not modify parent', (done) -> - page = path.join fixtures, 'pages', 'change-parent.html' + describe 'iframe', -> + page = path.join fixtures, 'pages', 'change-parent.html' + + beforeEach -> global.changedByIframe = false - iframe = $('