LadybirdBrowser
Site isolation
We should implement site isolation, where each site (scheme + domain + port) gets its own WebContent process, and code from each origin only runs in that process.
When one site embeds an iframe from another site, we'll have two WebContent processes who will have to coordinate communication, layout, rendering, input, etc.
Here's how they've done it in Chromium: https://www.chromium.org/Home/chromium-security/site-isolation/
A related issue is site sandboxing, which is ensuring that a compromised renderer process cannot access or tamper with data for origins it isn’t responsible for.
That’s arguably a separate issue (for which this one is a prerequisite), but I’m mentioning it here because site isolation without site sandboxing only protects against information leaks, not code execution.
#3882 implements "simple" site isolation for "sites" (TLD + one level, as in the chromium description). Nice!
Since this is done in Navigable::navigate, it should also apply to iframes?
Would be good to know whether this issue is still considered open, incl. remaining scope.
- #3882 only mentions one limitation: redirects.
- #3958 seems like a regression issue
Since this is done in Navigable::navigate, it should also apply to iframes?
nope, because currently all iframes live within one webcontent process.
Would be good to know whether this issue is still considered open, incl. remaining scope.
From a security perspective, yes. Full site isolation requires that all cross-origin iframes be in separate processes.