[html5] r7053 - [e] (0) Refactor the sandboxing flags further to make it even easier to hook int [...]
whatwg at whatwg.org
whatwg at whatwg.org
Fri Apr 13 16:10:04 PDT 2012
Author: ianh
Date: 2012-04-13 16:10:03 -0700 (Fri, 13 Apr 2012)
New Revision: 7053
Modified:
complete.html
index
source
Log:
[e] (0) Refactor the sandboxing flags further to make it even easier to hook into for CSP.
Affected topics: HTML
Modified: complete.html
===================================================================
--- complete.html 2012-04-13 22:55:46 UTC (rev 7052)
+++ complete.html 2012-04-13 23:10:03 UTC (rev 7053)
@@ -25359,81 +25359,13 @@
-->
<p>While the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code>
- attribute is specified, the <code><a href=#the-iframe-element>iframe</a></code> element's
- <a href=#nested-browsing-context>nested browsing context</a>'s <a href=#iframe-sandboxing-flag-set><code>iframe</code>
- sandboxing flag set</a> must have the flags given in the
- following list set.</p>
+ attribute is set or changed, the user agent must <a href=#parse-a-sandboxing-directive title="parse
+ a sandboxing directive">parse the sandboxing directive</a> using
+ the attribute's value as the <var title="">input</var> and the
+ <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>'s
+ <a href=#iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag set</a> as the
+ output.</p>
- <ul><li><p>The <a href=#sandboxed-navigation-browsing-context-flag>sandboxed navigation browsing context flag</a></li>
-
- <li><p>The <a href=#sandboxed-top-level-navigation-browsing-context-flag>sandboxed top-level navigation browsing context
- flag</a>, unless the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's value, when
- <a href=#split-a-string-on-spaces title="split a string on spaces">split on spaces</a>, is
- found to have the <dfn id=attr-iframe-sandbox-allow-top-navigation title=attr-iframe-sandbox-allow-top-navigation><code>allow-top-navigation</code></dfn>
- keyword set</li>
-
- <li><p>The <a href=#sandboxed-plugins-browsing-context-flag>sandboxed plugins browsing context flag</a></li>
-
- <li><p>The <a href=#sandboxed-seamless-iframes-flag>sandboxed seamless iframes flag</a></li>
-
- <li>
-
- <p>The <a href=#sandboxed-origin-browsing-context-flag>sandboxed origin browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-same-origin title=attr-iframe-sandbox-allow-same-origin><code>allow-same-origin</code></dfn>
- keyword set</p>
-
- <div class=note>
-
- <p>The <code title=attr-iframe-sandbox-allow-same-origin><a href=#attr-iframe-sandbox-allow-same-origin>allow-same-origin</a></code>
- keyword is intended for two cases.</p>
-
- <p>First, it can be used to allow content from the same site to
- be sandboxed to disable scripting, while still allowing access to
- the DOM of the sandboxed content.</p>
-
- <p>Second, it can be used to embed content from a third-party
- site, sandboxed to prevent that site from opening popup windows,
- etc, without preventing the embedded page from communicating back
- to its originating site, using the database APIs to store data,
- etc.</p>
-
- </div>
-
- </li>
-
- <li><p>The <a href=#sandboxed-forms-browsing-context-flag>sandboxed forms browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-forms title=attr-iframe-sandbox-allow-forms><code>allow-forms</code></dfn>
- keyword set</li>
-
- <li><p>The <a href=#sandboxed-scripts-browsing-context-flag>sandboxed scripts browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-scripts title=attr-iframe-sandbox-allow-scripts><code>allow-scripts</code></dfn>
- keyword set</li>
-
- <li>
-
- <p>The <a href=#sandboxed-automatic-features-browsing-context-flag>sandboxed automatic features browsing context
- flag</a>, unless the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's value, when
- <a href=#split-a-string-on-spaces title="split a string on spaces">split on spaces</a>, is
- found to have the <code title=attr-iframe-sandbox-allow-scripts><a href=#attr-iframe-sandbox-allow-scripts>allow-scripts</a></code>
- keyword (defined above) set</p>
-
- <p class=note>This flag is relaxed by the same flag as
- scripts, because when scripts are enabled these features are
- trivially possible anyway, and it would be unfortunate to force
- authors to use script to do them when sandboxed rather than
- allowing them to use the declarative features.</p>
-
- </li>
-
- </ul><p>These flags must not be set unless the conditions listed above
- define them as being set.</p>
-
<p class=warning>These flags only take effect when the
<a href=#nested-browsing-context>nested browsing context</a> of the <code><a href=#the-iframe-element>iframe</a></code> is
<a href=#navigate title=navigate>navigated</a>. Removing them, or removing
@@ -65547,7 +65479,80 @@
</dd>
- </dl><p>Every <a href=#nested-browsing-context>nested browsing context</a> has an
+ </dl><p>When the user agent is to <dfn id=parse-a-sandboxing-directive>parse a sandboxing
+ directive</dfn>, given a string <var title="">input</var> and a
+ <a href=#sandboxing-flag-set>sandboxing flag set</a> <var title="">output</var>, it must
+ run the following steps:</p>
+
+ <ol><li><p><a href=#split-a-string-on-spaces title="split a string on spaces">Split <var title="">input</var> on spaces</a>, to obtain <var title="">tokens</var>.</li>
+
+ <li><p>Let <var title="">output</var> be empty.</li>
+
+ <li>
+
+ <p>Add the following flags to <var title="">output</var>:</p>
+
+ <ul><li><p>The <a href=#sandboxed-navigation-browsing-context-flag>sandboxed navigation browsing context flag</a></li>
+
+ <li><p>The <a href=#sandboxed-top-level-navigation-browsing-context-flag>sandboxed top-level navigation browsing context
+ flag</a>, unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-top-navigation title=attr-iframe-sandbox-allow-top-navigation><code>allow-top-navigation</code></dfn>
+ keyword</li>
+
+ <li><p>The <a href=#sandboxed-plugins-browsing-context-flag>sandboxed plugins browsing context flag</a></li>
+
+ <li><p>The <a href=#sandboxed-seamless-iframes-flag>sandboxed seamless iframes flag</a></li>
+
+ <li>
+
+ <p>The <a href=#sandboxed-origin-browsing-context-flag>sandboxed origin browsing context flag</a>,
+ unless the <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-same-origin title=attr-iframe-sandbox-allow-same-origin><code>allow-same-origin</code></dfn>
+ keyword</p>
+
+ <div class=note>
+
+ <p>The <code title=attr-iframe-sandbox-allow-same-origin><a href=#attr-iframe-sandbox-allow-same-origin>allow-same-origin</a></code>
+ keyword is intended for two cases.</p>
+
+ <p>First, it can be used to allow content from the same site to
+ be sandboxed to disable scripting, while still allowing access to
+ the DOM of the sandboxed content.</p>
+
+ <p>Second, it can be used to embed content from a third-party
+ site, sandboxed to prevent that site from opening popup windows,
+ etc, without preventing the embedded page from communicating back
+ to its originating site, using the database APIs to store data,
+ etc.</p>
+
+ </div>
+
+ </li>
+
+ <li><p>The <a href=#sandboxed-forms-browsing-context-flag>sandboxed forms browsing context flag</a>,
+ unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-forms title=attr-iframe-sandbox-allow-forms><code>allow-forms</code></dfn>
+ keyword</li>
+
+ <li><p>The <a href=#sandboxed-scripts-browsing-context-flag>sandboxed scripts browsing context flag</a>,
+ unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-scripts title=attr-iframe-sandbox-allow-scripts><code>allow-scripts</code></dfn>
+ keyword</li>
+
+ <li>
+
+ <p>The <a href=#sandboxed-automatic-features-browsing-context-flag>sandboxed automatic features browsing context
+ flag</a>, unless <var title="">tokens</var> contains the
+ <code title=attr-iframe-sandbox-allow-scripts><a href=#attr-iframe-sandbox-allow-scripts>allow-scripts</a></code>
+ keyword (defined above)</p>
+
+ <p class=note>This flag is relaxed by the same keyword as
+ scripts, because when scripts are enabled these features are
+ trivially possible anyway, and it would be unfortunate to force
+ authors to use script to do them when sandboxed rather than
+ allowing them to use the declarative features.</p>
+
+ </li>
+
+ </ul></li>
+
+ </ol><hr><p>Every <a href=#nested-browsing-context>nested browsing context</a> has an
<dfn id=iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag set</dfn>, which is a
<a href=#sandboxing-flag-set>sandboxing flag set</a>. Which flags in a <a href=#nested-browsing-context>nested
browsing context</a>'s <a href=#iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag
Modified: index
===================================================================
--- index 2012-04-13 22:55:46 UTC (rev 7052)
+++ index 2012-04-13 23:10:03 UTC (rev 7053)
@@ -25359,81 +25359,13 @@
-->
<p>While the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code>
- attribute is specified, the <code><a href=#the-iframe-element>iframe</a></code> element's
- <a href=#nested-browsing-context>nested browsing context</a>'s <a href=#iframe-sandboxing-flag-set><code>iframe</code>
- sandboxing flag set</a> must have the flags given in the
- following list set.</p>
+ attribute is set or changed, the user agent must <a href=#parse-a-sandboxing-directive title="parse
+ a sandboxing directive">parse the sandboxing directive</a> using
+ the attribute's value as the <var title="">input</var> and the
+ <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>'s
+ <a href=#iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag set</a> as the
+ output.</p>
- <ul><li><p>The <a href=#sandboxed-navigation-browsing-context-flag>sandboxed navigation browsing context flag</a></li>
-
- <li><p>The <a href=#sandboxed-top-level-navigation-browsing-context-flag>sandboxed top-level navigation browsing context
- flag</a>, unless the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's value, when
- <a href=#split-a-string-on-spaces title="split a string on spaces">split on spaces</a>, is
- found to have the <dfn id=attr-iframe-sandbox-allow-top-navigation title=attr-iframe-sandbox-allow-top-navigation><code>allow-top-navigation</code></dfn>
- keyword set</li>
-
- <li><p>The <a href=#sandboxed-plugins-browsing-context-flag>sandboxed plugins browsing context flag</a></li>
-
- <li><p>The <a href=#sandboxed-seamless-iframes-flag>sandboxed seamless iframes flag</a></li>
-
- <li>
-
- <p>The <a href=#sandboxed-origin-browsing-context-flag>sandboxed origin browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-same-origin title=attr-iframe-sandbox-allow-same-origin><code>allow-same-origin</code></dfn>
- keyword set</p>
-
- <div class=note>
-
- <p>The <code title=attr-iframe-sandbox-allow-same-origin><a href=#attr-iframe-sandbox-allow-same-origin>allow-same-origin</a></code>
- keyword is intended for two cases.</p>
-
- <p>First, it can be used to allow content from the same site to
- be sandboxed to disable scripting, while still allowing access to
- the DOM of the sandboxed content.</p>
-
- <p>Second, it can be used to embed content from a third-party
- site, sandboxed to prevent that site from opening popup windows,
- etc, without preventing the embedded page from communicating back
- to its originating site, using the database APIs to store data,
- etc.</p>
-
- </div>
-
- </li>
-
- <li><p>The <a href=#sandboxed-forms-browsing-context-flag>sandboxed forms browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-forms title=attr-iframe-sandbox-allow-forms><code>allow-forms</code></dfn>
- keyword set</li>
-
- <li><p>The <a href=#sandboxed-scripts-browsing-context-flag>sandboxed scripts browsing context flag</a>, unless
- the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's
- value, when <a href=#split-a-string-on-spaces title="split a string on spaces">split on
- spaces</a>, is found to have the <dfn id=attr-iframe-sandbox-allow-scripts title=attr-iframe-sandbox-allow-scripts><code>allow-scripts</code></dfn>
- keyword set</li>
-
- <li>
-
- <p>The <a href=#sandboxed-automatic-features-browsing-context-flag>sandboxed automatic features browsing context
- flag</a>, unless the <code title=attr-iframe-sandbox><a href=#attr-iframe-sandbox>sandbox</a></code> attribute's value, when
- <a href=#split-a-string-on-spaces title="split a string on spaces">split on spaces</a>, is
- found to have the <code title=attr-iframe-sandbox-allow-scripts><a href=#attr-iframe-sandbox-allow-scripts>allow-scripts</a></code>
- keyword (defined above) set</p>
-
- <p class=note>This flag is relaxed by the same flag as
- scripts, because when scripts are enabled these features are
- trivially possible anyway, and it would be unfortunate to force
- authors to use script to do them when sandboxed rather than
- allowing them to use the declarative features.</p>
-
- </li>
-
- </ul><p>These flags must not be set unless the conditions listed above
- define them as being set.</p>
-
<p class=warning>These flags only take effect when the
<a href=#nested-browsing-context>nested browsing context</a> of the <code><a href=#the-iframe-element>iframe</a></code> is
<a href=#navigate title=navigate>navigated</a>. Removing them, or removing
@@ -65547,7 +65479,80 @@
</dd>
- </dl><p>Every <a href=#nested-browsing-context>nested browsing context</a> has an
+ </dl><p>When the user agent is to <dfn id=parse-a-sandboxing-directive>parse a sandboxing
+ directive</dfn>, given a string <var title="">input</var> and a
+ <a href=#sandboxing-flag-set>sandboxing flag set</a> <var title="">output</var>, it must
+ run the following steps:</p>
+
+ <ol><li><p><a href=#split-a-string-on-spaces title="split a string on spaces">Split <var title="">input</var> on spaces</a>, to obtain <var title="">tokens</var>.</li>
+
+ <li><p>Let <var title="">output</var> be empty.</li>
+
+ <li>
+
+ <p>Add the following flags to <var title="">output</var>:</p>
+
+ <ul><li><p>The <a href=#sandboxed-navigation-browsing-context-flag>sandboxed navigation browsing context flag</a></li>
+
+ <li><p>The <a href=#sandboxed-top-level-navigation-browsing-context-flag>sandboxed top-level navigation browsing context
+ flag</a>, unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-top-navigation title=attr-iframe-sandbox-allow-top-navigation><code>allow-top-navigation</code></dfn>
+ keyword</li>
+
+ <li><p>The <a href=#sandboxed-plugins-browsing-context-flag>sandboxed plugins browsing context flag</a></li>
+
+ <li><p>The <a href=#sandboxed-seamless-iframes-flag>sandboxed seamless iframes flag</a></li>
+
+ <li>
+
+ <p>The <a href=#sandboxed-origin-browsing-context-flag>sandboxed origin browsing context flag</a>,
+ unless the <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-same-origin title=attr-iframe-sandbox-allow-same-origin><code>allow-same-origin</code></dfn>
+ keyword</p>
+
+ <div class=note>
+
+ <p>The <code title=attr-iframe-sandbox-allow-same-origin><a href=#attr-iframe-sandbox-allow-same-origin>allow-same-origin</a></code>
+ keyword is intended for two cases.</p>
+
+ <p>First, it can be used to allow content from the same site to
+ be sandboxed to disable scripting, while still allowing access to
+ the DOM of the sandboxed content.</p>
+
+ <p>Second, it can be used to embed content from a third-party
+ site, sandboxed to prevent that site from opening popup windows,
+ etc, without preventing the embedded page from communicating back
+ to its originating site, using the database APIs to store data,
+ etc.</p>
+
+ </div>
+
+ </li>
+
+ <li><p>The <a href=#sandboxed-forms-browsing-context-flag>sandboxed forms browsing context flag</a>,
+ unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-forms title=attr-iframe-sandbox-allow-forms><code>allow-forms</code></dfn>
+ keyword</li>
+
+ <li><p>The <a href=#sandboxed-scripts-browsing-context-flag>sandboxed scripts browsing context flag</a>,
+ unless <var title="">tokens</var> contains the <dfn id=attr-iframe-sandbox-allow-scripts title=attr-iframe-sandbox-allow-scripts><code>allow-scripts</code></dfn>
+ keyword</li>
+
+ <li>
+
+ <p>The <a href=#sandboxed-automatic-features-browsing-context-flag>sandboxed automatic features browsing context
+ flag</a>, unless <var title="">tokens</var> contains the
+ <code title=attr-iframe-sandbox-allow-scripts><a href=#attr-iframe-sandbox-allow-scripts>allow-scripts</a></code>
+ keyword (defined above)</p>
+
+ <p class=note>This flag is relaxed by the same keyword as
+ scripts, because when scripts are enabled these features are
+ trivially possible anyway, and it would be unfortunate to force
+ authors to use script to do them when sandboxed rather than
+ allowing them to use the declarative features.</p>
+
+ </li>
+
+ </ul></li>
+
+ </ol><hr><p>Every <a href=#nested-browsing-context>nested browsing context</a> has an
<dfn id=iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag set</dfn>, which is a
<a href=#sandboxing-flag-set>sandboxing flag set</a>. Which flags in a <a href=#nested-browsing-context>nested
browsing context</a>'s <a href=#iframe-sandboxing-flag-set><code>iframe</code> sandboxing flag
Modified: source
===================================================================
--- source 2012-04-13 22:55:46 UTC (rev 7052)
+++ source 2012-04-13 23:10:03 UTC (rev 7053)
@@ -27244,93 +27244,13 @@
-->
<p>While the <code title="attr-iframe-sandbox">sandbox</code>
- attribute is specified, the <code>iframe</code> element's
- <span>nested browsing context</span>'s <span><code>iframe</code>
- sandboxing flag set</span> must have the flags given in the
- following list set.</p>
+ attribute is set or changed, the user agent must <span title="parse
+ a sandboxing directive">parse the sandboxing directive</span> using
+ the attribute's value as the <var title="">input</var> and the
+ <code>iframe</code> element's <span>nested browsing context</span>'s
+ <span><code>iframe</code> sandboxing flag set</span> as the
+ output.</p>
- <ul>
-
- <li><p>The <span>sandboxed navigation browsing context flag</span></p></li>
-
- <li><p>The <span>sandboxed top-level navigation browsing context
- flag</span>, unless the <code
- title="attr-iframe-sandbox">sandbox</code> attribute's value, when
- <span title="split a string on spaces">split on spaces</span>, is
- found to have the <dfn
- title="attr-iframe-sandbox-allow-top-navigation"><code>allow-top-navigation</code></dfn>
- keyword set</p></li>
-
- <li><p>The <span>sandboxed plugins browsing context flag</span></p></li>
-
- <li><p>The <span>sandboxed seamless iframes flag</span></p></li>
-
- <li>
-
- <p>The <span>sandboxed origin browsing context flag</span>, unless
- the <code title="attr-iframe-sandbox">sandbox</code> attribute's
- value, when <span title="split a string on spaces">split on
- spaces</span>, is found to have the <dfn
- title="attr-iframe-sandbox-allow-same-origin"><code>allow-same-origin</code></dfn>
- keyword set</p>
-
- <div class="note">
-
- <p>The <code
- title="attr-iframe-sandbox-allow-same-origin">allow-same-origin</code>
- keyword is intended for two cases.</p>
-
- <p>First, it can be used to allow content from the same site to
- be sandboxed to disable scripting, while still allowing access to
- the DOM of the sandboxed content.</p>
-
- <p>Second, it can be used to embed content from a third-party
- site, sandboxed to prevent that site from opening popup windows,
- etc, without preventing the embedded page from communicating back
- to its originating site, using the database APIs to store data,
- etc.</p>
-
- </div>
-
- </li>
-
- <li><p>The <span>sandboxed forms browsing context flag</span>, unless
- the <code title="attr-iframe-sandbox">sandbox</code> attribute's
- value, when <span title="split a string on spaces">split on
- spaces</span>, is found to have the <dfn
- title="attr-iframe-sandbox-allow-forms"><code>allow-forms</code></dfn>
- keyword set</p></li>
-
- <li><p>The <span>sandboxed scripts browsing context flag</span>, unless
- the <code title="attr-iframe-sandbox">sandbox</code> attribute's
- value, when <span title="split a string on spaces">split on
- spaces</span>, is found to have the <dfn
- title="attr-iframe-sandbox-allow-scripts"><code>allow-scripts</code></dfn>
- keyword set</p></li>
-
- <li>
-
- <p>The <span>sandboxed automatic features browsing context
- flag</span>, unless the <code
- title="attr-iframe-sandbox">sandbox</code> attribute's value, when
- <span title="split a string on spaces">split on spaces</span>, is
- found to have the <code
- title="attr-iframe-sandbox-allow-scripts">allow-scripts</code>
- keyword (defined above) set</p>
-
- <p class="note">This flag is relaxed by the same flag as
- scripts, because when scripts are enabled these features are
- trivially possible anyway, and it would be unfortunate to force
- authors to use script to do them when sandboxed rather than
- allowing them to use the declarative features.</p>
-
- </li>
-
- </ul>
-
- <p>These flags must not be set unless the conditions listed above
- define them as being set.</p>
-
<p class="warning">These flags only take effect when the
<span>nested browsing context</span> of the <code>iframe</code> is
<span title="navigate">navigated</span>. Removing them, or removing
@@ -76727,6 +76647,97 @@
</dl>
+ <p>When the user agent is to <dfn>parse a sandboxing
+ directive</dfn>, given a string <var title="">input</var> and a
+ <span>sandboxing flag set</span> <var title="">output</var>, it must
+ run the following steps:</p>
+
+ <ol>
+
+ <li><p><span title="split a string on spaces">Split <var
+ title="">input</var> on spaces</span>, to obtain <var
+ title="">tokens</var>.</p></li>
+
+ <li><p>Let <var title="">output</var> be empty.</p></li>
+
+ <li>
+
+ <p>Add the following flags to <var title="">output</var>:</p>
+
+ <ul>
+
+ <li><p>The <span>sandboxed navigation browsing context flag</span></p></li>
+
+ <li><p>The <span>sandboxed top-level navigation browsing context
+ flag</span>, unless <var title="">tokens</var> contains the <dfn
+ title="attr-iframe-sandbox-allow-top-navigation"><code>allow-top-navigation</code></dfn>
+ keyword</p></li>
+
+ <li><p>The <span>sandboxed plugins browsing context flag</span></p></li>
+
+ <li><p>The <span>sandboxed seamless iframes flag</span></p></li>
+
+ <li>
+
+ <p>The <span>sandboxed origin browsing context flag</span>,
+ unless the <var title="">tokens</var> contains the <dfn
+ title="attr-iframe-sandbox-allow-same-origin"><code>allow-same-origin</code></dfn>
+ keyword</p>
+
+ <div class="note">
+
+ <p>The <code
+ title="attr-iframe-sandbox-allow-same-origin">allow-same-origin</code>
+ keyword is intended for two cases.</p>
+
+ <p>First, it can be used to allow content from the same site to
+ be sandboxed to disable scripting, while still allowing access to
+ the DOM of the sandboxed content.</p>
+
+ <p>Second, it can be used to embed content from a third-party
+ site, sandboxed to prevent that site from opening popup windows,
+ etc, without preventing the embedded page from communicating back
+ to its originating site, using the database APIs to store data,
+ etc.</p>
+
+ </div>
+
+ </li>
+
+ <li><p>The <span>sandboxed forms browsing context flag</span>,
+ unless <var title="">tokens</var> contains the <dfn
+ title="attr-iframe-sandbox-allow-forms"><code>allow-forms</code></dfn>
+ keyword</p></li>
+
+ <li><p>The <span>sandboxed scripts browsing context flag</span>,
+ unless <var title="">tokens</var> contains the <dfn
+ title="attr-iframe-sandbox-allow-scripts"><code>allow-scripts</code></dfn>
+ keyword</p></li>
+
+ <li>
+
+ <p>The <span>sandboxed automatic features browsing context
+ flag</span>, unless <var title="">tokens</var> contains the
+ <code
+ title="attr-iframe-sandbox-allow-scripts">allow-scripts</code>
+ keyword (defined above)</p>
+
+ <p class="note">This flag is relaxed by the same keyword as
+ scripts, because when scripts are enabled these features are
+ trivially possible anyway, and it would be unfortunate to force
+ authors to use script to do them when sandboxed rather than
+ allowing them to use the declarative features.</p>
+
+ </li>
+
+ </ul>
+
+ </li>
+
+ </ol>
+
+ <hr>
+
<p>Every <span>nested browsing context</span> has an
<dfn><code>iframe</code> sandboxing flag set</dfn>, which is a
<span>sandboxing flag set</span>. Which flags in a <span>nested
More information about the Commit-Watchers
mailing list