fix(browser): drop --disable-web-security from default Chrome flags

CHANGELOG.md

@@ -3,6 +3,9 @@
 ### Added
 
 ### Changed
+- `--disable-web-security` is no longer among the default Chrome flags, so pages keep the same-origin policy and an
+  untrusted page can't read local files with `<iframe src="file:///etc/passwd">`. `Frame#frame_element` returns `nil`
+  for a cross-origin frame now. Pass `browser_options: { "disable-web-security" => nil }` for the old behavior [#472]
 
 ### Fixed
 - A paused request with a binary body, e.g. a `Blob` upload with `blacklist=`/`whitelist=` set, hung forever: Chrome

docs/15-frames.md

@@ -55,7 +55,9 @@ Parent frame if this one is nested in another one.
 
 #### frame_element : `Node | nil`
 
-Returns the element in which the window is embedded.
+Returns the element in which the window is embedded. It's `nil` for the main
+frame and for a frame from a different origin than its parent, since the
+same-origin policy hides `window.frameElement` from a cross-origin frame.
 
 #### execution_id : `Integer`
 

lib/ferrum/browser/options/chrome.rb

@@ -48,7 +48,6 @@ class Chrome < Base
           "disable-smooth-scrolling" => nil,
           "disable-sync" => nil,
           "disable-translate" => nil,
-          "disable-web-security" => nil,
           "enable-automation" => nil,
           "enable-features" => %w[
             NetworkService

lib/ferrum/frame/dom.rb

@@ -116,7 +116,8 @@ def body
       # Returns the element in which the window is embedded.
       #
       # @return [Node, nil]
-      #   The element in which the window is embedded.
+      #   The element in which the window is embedded, `nil` for the main frame
+      #   and for a frame from a different origin than its parent.
       #
       # @example
       #   browser.go_to("https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe")

spec/browser_spec.rb

@@ -55,14 +55,31 @@
     end
 
     it "supports :ignore_default_browser_options argument" do
-      defaults = Ferrum::Browser::Options::Chrome.options.except("disable-web-security")
+      defaults = Ferrum::Browser::Options::Chrome.options.except("mute-audio")
       browser = Ferrum::Browser.new(ignore_default_browser_options: true,
                                     browser_options: defaults.merge("no-sandbox" => nil))
       browser.go_to(base_url("/console_log"))
+
+      flags = browser.process.command.to_a
+      expect(flags).not_to include("--mute-audio")
+      expect(flags).to include("--no-sandbox")
+      expect(flags).to include(a_string_starting_with("--remote-debugging-port="))
+      expect(flags).to include(a_string_starting_with("--user-data-dir="))
     ensure
       browser&.quit
     end
 
+    it "keeps the same-origin policy by default" do
+      browser.go_to("/frames")
+
+      result = browser.evaluate_async(<<~JS, browser.timeout)
+        fetch("http://localhost:" + location.port + "/headers")
+          .then(() => arguments[0]("read"), () => arguments[0]("blocked"))
+      JS
+
+      expect(result).to eq("blocked")
+    end
+
     it "supports :process_timeout argument" do
       path = "#{PROJECT_ROOT}/spec/support/no_chrome"
 

spec/frame_spec.rb

@@ -234,13 +234,20 @@
 
   context "#frame_element" do
     it "gets the frame element" do
-      page.go_to("/frames")
+      page.go_to("/frame_parent")
 
       frame_element = page.at_xpath("//iframe")
       frame = frame_element.frame
       expect(frame.frame_element).to eq(frame_element)
       expect(frame.frame_element.frame_id).to eq frame.id
-      expect(frame.frame_element.attribute(:src)).to end_with("/slow")
+      expect(frame.frame_element.attribute(:src)).to eq("/frame_child")
+    end
+
+    it "returns nil for a cross-origin frame" do
+      page.go_to("/frames")
+
+      frame = page.at_xpath("//iframe").frame
+      expect(frame.frame_element).to be_nil
     end
 
     it "returns nil if main frame" do