') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(trace-viewer): block meta refresh and sandbox snapshot iframes by yury-s · Pull Request #40115 · microsoft/playwright · GitHub
Skip to content

fix(trace-viewer): block meta refresh and sandbox snapshot iframes - #40115

Merged
Yury Semikhatsky (yury-s) merged 1 commit into
microsoft:mainfrom
yury-s:fix-trace-viewer-meta-refresh
Apr 8, 2026
Merged

fix(trace-viewer): block meta refresh and sandbox snapshot iframes#40115
Yury Semikhatsky (yury-s) merged 1 commit into
microsoft:mainfrom
yury-s:fix-trace-viewer-meta-refresh

Conversation

@yury-s

@yury-sYury Semikhatsky (yury-s) commented Apr 8, 2026

Copy link
Copy Markdown
Member

A crafted trace could embed a META http-equiv=refresh directive that navigated the snapshot iframe to attacker-controlled HTML served from the trace viewer origin, executing script in the trusted viewer context.

Defense in depth:

  • Strip http-equiv=refresh META directives during snapshot recording
  • During snapshot rendering, allow only a small whitelist of META http-equiv directives
  • Sandbox the trace viewer snapshot iframes with "allow-same-origin allow-scripts" to block top navigation, popups, downloads, forms, and other capabilities that legitimate snapshots do not need.

@yury-s
fix(trace-viewer): block meta refresh and sandbox snapshot iframes
14123fd
A crafted trace could embed a META http-equiv=refresh directive that
navigated the snapshot iframe to attacker-controlled HTML served from
the trace viewer origin, executing script in the trusted viewer context.
Defense in depth:
- Strip http-equiv=refresh and set-cookie META directives during snapshot
recording (alongside the existing CSP filter).
- During snapshot rendering, allow only a small whitelist of META
http-equiv directives; neutralize others by renaming the http-equiv and
content attributes so the browser ignores them. Protects pre-existing
traces.
- Sandbox the trace viewer snapshot iframes with
"allow-same-origin allow-scripts" to block top navigation, popups,
downloads, forms, and other capabilities that legitimate snapshots
do not need.
@yury-s
Yury Semikhatsky (yury-s) merged commit 395696e into microsoft:mainApr 8, 2026
35 of 37 checks passed
@yury-s
Yury Semikhatsky (yury-s) deleted the fix-trace-viewer-meta-refresh branch April 8, 2026 18:50
@github-actions

github-actionsBot commented Apr 8, 2026

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

1 failed
❌ [playwright-test] › ui-mode-test-network-tab.spec.ts:395 › should copy network request @macos-latest-node20

9 flaky⚠️ [chromium-library] › library/video.spec.ts:342 › screencast › should work for popups `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/video.spec.ts:481 › screencast › should capture static page in persistent context Radoslav Kirilov (@smoke) `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/video.spec.ts:724 › screencast › should work with video+trace `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/video.spec.ts:118 › screencast › should capture static page `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/beforeunload.spec.ts:130 › should support dismissing the dialog multiple times `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-page] › page/page-request-continue.spec.ts:754 › propagate headers cross origin redirect after interception `@chromium-ubuntu-22.04-node24`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-emulate-media.spec.ts:144 › should keep reduced motion and color emulation after reload `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

39180 passed, 846 skipped

Merge workflow run.

This was referenced Apr 8, 2026
Closed
Closed
Closed
@github-actions

github-actionsBot commented Apr 8, 2026

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/cli-core.spec.ts:89 › fill numeric @mcp-macos-latest

6441 passed, 383 skipped

Merge workflow run.

This was referenced May 6, 2026
Merged
Merged
Merged
@YusukeIwakiYusuke Iwaki (YusukeIwaki) mentioned this pull request May 17, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dgozmanDmitry Gozman (dgozman)dgozman approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yury-s@dgozman