Don't propagate sandbox flags to an opened window unless triggered entirely by script.

Source/core/page/CreateWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 63 matching lines @@
         return 0;
 
     Page* page = oldPage->chrome().client().createWindow(&openerFrame, request, features, policy, shouldSendReferrer);
     if (!page)
         return 0;
     FrameHost* host = &page->frameHost();
 
     ASSERT(page->mainFrame());
     LocalFrame& frame = *page->mainFrame();
 
-    frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
-
     if (request.frameName() != "_blank")
         frame.tree().setName(request.frameName());
 
     host->chrome().setWindowFeatures(features);
 
     // 'x' and 'y' specify the location of the window, while 'width' and 'height'
     // specify the size of the viewport. We can only resize the window, so adjust
     // for the difference between the window size and the viewport size.
 
     FloatRect windowRect = host->chrome().windowRect();
@@ skipping 38 matching lines @@
     FrameLoader::addHTTPOriginIfNeeded(request, AtomicString(firstFrame.document()->outgoingOrigin()));
     FrameLoadRequest frameRequest(callingWindow.document(), request, frameName);
 
     // We pass the opener frame for the lookupFrame in case the active frame is different from
     // the opener frame, and the name references a frame relative to the opener frame.
     bool created;
     LocalFrame* newFrame = createWindow(*activeFrame, openerFrame, frameRequest, windowFeatures, NavigationPolicyIgnore, MaybeSendReferrer, created);
     if (!newFrame)
         return 0;
 
+    if (newFrame != &openerFrame && newFrame != openerFrame.tree().top())
+        newFrame->loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
+
     newFrame->loader().setOpener(&openerFrame);
     newFrame->page()->setOpenedByDOM();
 
     if (newFrame->domWindow()->isInsecureScriptAccess(callingWindow, completedURL))
         return newFrame;
 
     if (function)
         function(newFrame->domWindow(), functionContext);
 
     if (created) {
@@ skipping 28 matching lines @@
     if (shouldSendReferrer == MaybeSendReferrer) {
         newFrame->loader().setOpener(&openerFrame);
         newFrame->document()->setReferrerPolicy(openerFrame.document()->referrerPolicy());
     }
     FrameLoadRequest newRequest(0, request.resourceRequest());
     newRequest.setFormState(request.formState());
     newFrame->loader().load(newRequest);
 }
 
 } // namespace WebCore