InformAction Forums

A written iframe takes on the URL of the parent and should be allowed if the parent is allowed, and should not be affected by about:blank permissions.

NS 2.0.9.4rc1, Fx 3.6.13, new profile, remove (msn.com, about:blank) from the whitelist.

1. login to https hotmail: https://mail.live.com/
2. once you get to the inbox, you'll see that the two ad iframes (1 - lower left, 2 - right column) are untrusted. They both have the url of their parent (InboxLight.aspx), which is trusted.
3. add about:blank back to the whitelist and refresh, the iframes now appear to be trusted

Investigating, thanks.

Another example of this is on the Amazon homepage. The dynamically added (via DOM it seems) iframe should be allowed, since amazon.com is, but isn't when about:blank is not whitelisted.

This started in 2.0.9.2. Can you repro?

fixed in a latter build