allow mozbrowser only for top level windows

1 files changed, 11 insertions, 4 deletions

diff --git a/components/script/dom/htmliframeelement.rs b/components/script/dom/htmliframeelement.rs
index 630b36e14e9..b59199d4909 100644
--- a/components/script/dom/htmliframeelement.rs
+++ b/components/script/dom/htmliframeelement.rs
@@ -360,7 +360,8 @@ pub fn Navigate(iframe: &HTMLIFrameElement, direction: NavigationDirection) -> F
 
         Ok(())
     } else {
-        debug!("this frame is not mozbrowser (or experimental_enabled is false)");
+        debug!("this frame is not mozbrowser: mozbrowser attribute missing, or not a top
+            level window, or mozbrowser preference not set (use --pref dom.mozbrowser.enabled)");
         Err(Error::NotSupported)
     }
 }
@@ -425,7 +426,9 @@ impl HTMLIFrameElementMethods for HTMLIFrameElement {
 
     // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-mozbrowser
     fn Mozbrowser(&self) -> bool {
-        if mozbrowser_enabled() {
+        // We don't want to allow mozbrowser iframes within iframes
+        let is_root_pipeline = window_from_node(self).parent_info().is_none();
+        if mozbrowser_enabled() && is_root_pipeline {
             let element = self.upcast::<Element>();
             element.has_attribute(&atom!("mozbrowser"))
         } else {
@@ -454,12 +457,16 @@ impl HTMLIFrameElementMethods for HTMLIFrameElement {
 
     // https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/reload
     fn Reload(&self, _hardReload: bool) -> Fallible<()> {
-        if mozbrowser_enabled() {
+        if self.Mozbrowser() {
             if self.upcast::<Node>().is_in_doc() {
                 self.navigate_or_reload_child_browsing_context(None);
             }
+            Ok(())
+        } else {
+            debug!("this frame is not mozbrowser: mozbrowser attribute missing, or not a top
+                level window, or mozbrowser preference not set (use --pref dom.mozbrowser.enabled)");
+            Err(Error::NotSupported)
         }
-        Ok(())
     }
 
     // https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/stop