What's the point of forbidding a sandboxed iframe with allow-scripts and allow-same-origin?

[danny08381 (Danny Lin)]

@juraj.masiar

3rd party remote script can be executed from simple string without any “content_security_policy” issues - simply by using browser.tabs.executeScript API. This is how most malicious addons works and the future Manifest V3 will remove this feature for this reason.

You can scan for scripts related with browser.tabs.executeScript for that. I don’t think this is relevant with the iframe issue.

@juraj.masiar

If you are loading HTTP page into iframe, than the remote page will load and run 3rd party script!

I don’t think this is true. The default content security policy will block all 3rd party scripts that are loaded into an extension iframe.

@juraj.masiar

The reviewers are skilled people so if you give them bad arguments than you sound suspicious. Note that all those malicious addons are made by developers like us so they may try to persuade them the same way you do! So reviewer needs to be able distinguish who is good and who is bad!

This is the basic logic: iframe[sandbox="allow-scripts allow-same-origin"] is no more open than a normal iframe. If iframe is considered safe enough and is generally allowed, there is no point to (generally) disallow iframe[sandbox="allow-scripts allow-same-origin"].

I do can workaround by replacing iframe[sandbox="allow-scripts allow-same-origin"] with a normal iframe, it’s just stupid and imperformant to block forms using more complicated scripts than a simple sandboxed iframe without the “allow-forms” value. And actually I have done this revision but the re-submission is still halted for more than 2 weeks—you don’t have a mechanism to review a re-submission together with the previous submission with the same reviewer?