Features/Platform/CSP Sandbox

From MozillaWiki
Jump to navigation Jump to search
Please use "Edit with form" above to edit this page.

Status

CSP Sandbox
Stage Development
Status In progress
Release target `
Health OK
Status note Sandbox is currently part of the CSP 1.1 spec

{{#set:Feature name=CSP Sandbox

|Feature stage=Development |Feature status=In progress |Feature version=` |Feature health=OK |Feature status note=Sandbox is currently part of the CSP 1.1 spec }}

Team

Product manager Sid Stamm
Directly Responsible Individual Devdatta Akhawe
Lead engineer `
Security lead Daniel Veditz
Privacy lead Sid Stamm
Localization lead `
Accessibility lead `
QA lead `
UX lead `
Product marketing lead `
Operations lead `
Additional members Tanvi Vyas, Devdatta Akhawe

{{#set:Feature product manager=Sid Stamm

|Feature feature manager=Devdatta Akhawe |Feature lead engineer=` |Feature security lead=Daniel Veditz |Feature privacy lead=Sid Stamm |Feature localization lead=` |Feature accessibility lead=` |Feature qa lead=` |Feature ux lead=` |Feature product marketing lead=` |Feature operations lead=` |Feature additional members=Tanvi Vyas, Devdatta Akhawe }}

Open issues/risks

  • need iframe sandbox (bug 341604) to land

Stage 1: Definition

1. Feature overview

2. Users & use cases

The CSP sandbox attribute is designed to allow sandboxing of content that cannot necessarily be wrapped in an iframe sandbox, or that can be accessed directly, avoiding any sandboxing that may be done by a containing iframe.

3. Dependencies

Requires the sandboxing infrastructure from https://wiki.mozilla.org/Features/Platform/Iframe_Sandbox

4. Requirements

Comply with the CSP spec's description of this feature

Non-goals

`

Stage 2: Design

5. Functional specification

`

6. User experience design

`

Stage 3: Planning

7. Implementation plan

`

8. Reviews

Security review

`

Privacy review

`

Localization review

`

Accessibility

`

Quality Assurance review

`

Operations review

`

Stage 4: Development

9. Implementation

`

Stage 5: Release

10. Landing criteria

` {{#set:Feature open issues and risks=* need iframe sandbox (bug 341604) to land |Feature overview=* https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#sandbox

|Feature users and use cases=The CSP sandbox attribute is designed to allow sandboxing of content that cannot necessarily be wrapped in an iframe sandbox, or that can be accessed directly, avoiding any sandboxing that may be done by a containing iframe. |Feature dependencies=Requires the sandboxing infrastructure from https://wiki.mozilla.org/Features/Platform/Iframe_Sandbox |Feature requirements=Comply with the CSP spec's description of this feature |Feature non-goals=` |Feature functional spec=` |Feature ux design=` |Feature implementation plan=` |Feature security review=` |Feature privacy review=` |Feature localization review=` |Feature accessibility review=` |Feature qa review=` |Feature operations review=` |Feature implementation notes=` |Feature landing criteria=` }}

Feature details

Priority P3
Rank 999
Theme / Goal Security Leadership
Roadmap Security
Secondary roadmap Platform
Feature list `
Project `
Engineering team Security

{{#set:Feature priority=P3

|Feature rank=999 |Feature theme=Security Leadership |Feature roadmap=Security |Feature secondary roadmap=Platform |Feature list=` |Feature project=` |Feature engineering team=Security }}

Team status notes

  status notes
Products ` `
Engineering ` `
Security ` `
Privacy ` `
Localization ` `
Accessibility ` `
Quality assurance ` `
User experience ` `
Product marketing ` `
Operations ` `

{{#set:Feature products status=`

|Feature products notes=` |Feature engineering status=` |Feature engineering notes=` |Feature security status=` |Feature security health=` |Feature security notes=` |Feature privacy status=` |Feature privacy notes=` |Feature localization status=` |Feature localization notes=` |Feature accessibility status=` |Feature accessibility notes=` |Feature qa status=` |Feature qa notes=` |Feature ux status=` |Feature ux notes=` |Feature product marketing status=` |Feature product marketing notes=` |Feature operations status=` |Feature operations notes=` }}