[security?] Iframe over Dat replaes top-frame over HTTPS

[da2x]

1. Load a normal webpage over HTTPS (no CORS or nonsense).

2. Attempt to load any resource in a sub-frame over Dat on that page

   <iframe src="dat://beakerbrowser.com/img/what-is-beaker.svg"></iframe>

The top frame is unexpectedly redirected to the sub-frame’s address; replacing the entire document with the contents of the iframe. This makes is difficult for use cases like peer-to-peer embedded videos.

Potentially a security vulnerability as any iframe can replace any document they’re loaded in. Unknown impact.

[sammacbeth]

This is likely an issue with the webextensions implementation of protocol handlers - these only work for main document requests. You should open an issue on bugzilla as this will probably be possible with any custom protocol.