Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

[HackerOne] media permission requests in iframes show top-level origin #5378

Closed
diracdeltas opened this issue Nov 3, 2016 · 3 comments
Closed

[HackerOne] media permission requests in iframes show top-level origin #5378

diracdeltas opened this issue Nov 3, 2016 · 3 comments
Assignees
@diracdeltas
Labels
QA/checked-Linux QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Milestone
0.12.10 release

Comments

@diracdeltas
Copy link
Member

diracdeltas commented Nov 3, 2016 •
edited
Loading

https://hackerone.com/reports/179749

Test Plan:

  1. go to https://jsfiddle.net/v1dugp3y/
  2. you should see a camera/microphone permission request from davidwalsh.name instead of jsfiddle.

cc @bridiver
@diracdeltas diracdeltas added this to the 0.12.9dev milestone Nov 3, 2016
@bbondy
Copy link
Member

bbondy commented Nov 11, 2016

@diracdeltas is this a regression? If not I think can we move on 0.12.10 because we didn't fix in time. Please let me know.

@diracdeltas
Copy link
Member Author

i'll move it, thanks

diracdeltas added a commit to brave/muon that referenced this issue Nov 11, 2016
@diracdeltas
Use security origin for media access permission requests
9eae22d 
Fix brave/browser-laptop#5378

Auditors: @bridiver
@diracdeltas diracdeltas mentioned this issue Nov 11, 2016
Merged
@diracdeltas diracdeltas changed the title [HackerOne] permission requests in iframes show top-level origin [HackerOne] media permission requests in iframes show top-level origin Nov 11, 2016
@diracdeltas
Copy link
Member Author

This is fixed by brave/muon#93

@diracdeltas diracdeltas self-assigned this Nov 11, 2016
This was referenced Nov 21, 2016
Closed
Closed
Closed
Closed
bridiver pushed a commit to brave/muon that referenced this issue Dec 9, 2016
@diracdeltas @bridiver
Use security origin for media access permission requests
17d0973 
Fix brave/browser-laptop#5378

Auditors: @bridiver
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@diracdeltas diracdeltas

Labels
QA/checked-Linux QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Projects
None yet
Milestone
0.12.10 release
Development

No branches or pull requests
5 participants
@diracdeltas @bbondy @alexwykoff @luixxiul @srirambv