User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0

Steps to reproduce:

• Frame a page that sets a CSP of frame-ancestors * in an iframe with sandbox but without allow-same-origin.
• Observe that the framing is allowed
• Example URL: http://sub.headers.websec.saarland/_hp/tests/framing.sub.html?resp_type=basic&browser_id=1&label=CSP-FA&first_id=19&last_id=19&scheme=http&t_resp_id=19&t_element_relation=iframe_sandbox&t_resp_origin=http://headers.webappsec.eu

Actual results:

• Framing is allowed: * matches the opaque origin of the sandboxed frame
• Framing is not allowed in Chromium and Safari

Expected results:

• Framing should not be allowed: https://www.w3.org/TR/CSP3/#match-url-to-source-expression
• * matches a URL with an HTTP(S) scheme or with the same scheme as the origin of the frame
• The opaque origin of the sandboxed frame does not fulfill these requirements and thus should not be allowed

Thank you jannis for reporting all these issues.

Realistically we should probably just go ahead and implement 6.7.2.7. Does url match source list in origin with redirect count?. Right now our current implementation is mostly in nsCSPHostSrc::permits, which is quite different from what is currently specified. However it's quite likely that current specification is also not actually web compatible.

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.