window.close() should work from a sandboxed iframe if iframe is opener

third_party/WebKit/Source/core/frame/Frame.cpp

Index: third_party/WebKit/Source/core/frame/Frame.cpp
diff --git a/third_party/WebKit/Source/core/frame/Frame.cpp b/third_party/WebKit/Source/core/frame/Frame.cpp
index aa7ce85b880f4ad16e4293355fa7a168b22f5cb3..3433a493c81f3d7725ea2df809c727d5e758a8e2 100644
--- a/third_party/WebKit/Source/core/frame/Frame.cpp
+++ b/third_party/WebKit/Source/core/frame/Frame.cpp
@@ -206,35 +206,44 @@ bool Frame::canNavigate(const Frame& targetFrame) {
 
 bool Frame::canNavigateWithoutFramebusting(const Frame& targetFrame,
                                            String& reason) {
-  if (securityContext()->isSandboxed(SandboxNavigation)) {
-    // Sandboxed frames can navigate their own children.
-    if (targetFrame.tree().isDescendantOf(this))
-      return true;
-
-    // They can also navigate popups, if the 'allow-sandbox-escape-via-popup'
-    // flag is specified.
-    if (targetFrame == targetFrame.tree().top() &&
-        targetFrame.tree().top() != tree().top() &&
-        !securityContext()->isSandboxed(
-            SandboxPropagatesToAuxiliaryBrowsingContexts))
-      return true;
-
-    // Top navigation can be opted-in.
-    if (!securityContext()->isSandboxed(SandboxTopNavigation) &&
-        targetFrame == tree().top())
-      return true;
+  if (&targetFrame == this)
+    return true;
 
-    // Otherwise, block the navigation.
-    if (securityContext()->isSandboxed(SandboxTopNavigation) &&
-        targetFrame == tree().top())
-      reason =
-          "The frame attempting navigation of the top-level window is "
-          "sandboxed, but the 'allow-top-navigation' flag is not set.";
-    else
+  if (securityContext()->isSandboxed(SandboxNavigation)) {
+    if (!targetFrame.tree().isDescendantOf(this) &&
+        !targetFrame.isMainFrame()) {

[Nate Chapin, 2016/11/01 23:47:52]

I inverted this block so that it more closely matches
https://html.spec.whatwg.org/multipage/browsers.html#allowed-to-navigate (albeit
with clauses 2 and 3 reversed).

       reason =
           "The frame attempting navigation is sandboxed, and is therefore "
           "disallowed from navigating its ancestors.";
-    return false;
+      return false;
+    }
+
+    // Sandboxed frames can also navigate popups, if the
+    // 'allow-sandbox-escape-via-popup' flag is specified, or if
+    // 'allow-popups' flag is specified, or if the
+    if (targetFrame.isMainFrame() && targetFrame != tree().top() &&
+        securityContext()->isSandboxed(
+            SandboxPropagatesToAuxiliaryBrowsingContexts) &&
+        (securityContext()->isSandboxed(SandboxPopups) ||
+         targetFrame.client()->opener() != this)) {
+      reason =
+          "The frame attempting navigation is sandboxed and is trying "
+          "to navigate a popup, but is not the popup's opener and is not "
+          "set to propagate sandboxing to popups.";
+      return false;
+    }
+
+    // Top navigation is forbidden unless opted-in. allow-top-navigation
+    // will also skips origin checks.
+    if (targetFrame == tree().top()) {
+      if (securityContext()->isSandboxed(SandboxTopNavigation)) {
+        reason =
+            "The frame attempting navigation of the top-level window is "
+            "sandboxed, but the 'allow-top-navigation' flag is not set.";
+        return false;
+      }
+      return true;

[Nate Chapin, 2016/11/01 23:47:52]

We seem to depend on skipping origin checks for allow-top-navigation.

This is complicated by the fact that the spec splits navigation permissions into
an "is familiar with" step and an "is allowed to navigate" step. We combine them
in this function: the "if (securityContext()->isSandboxed(SandboxNavigation))"
block corresponds to "is allowed to navigate", and the rest to "is familiar
with". 

"is familiar with" is used far less frequently, according to the spec, and it's
not clear to me that what the spec defines is actually what browsers do in
practice. The spec implies that an Location object you can reach without looking
up by name/target (that is, top, opener, and any of their descendants) can be
navigated without any familiarity requirements. That's not what we do, and it's
not what firefox does AFAICT.

+    }
   }
 
   ASSERT(securityContext()->getSecurityOrigin());