Add allow-same-origin to deck/spyglass sandbox

[fgimenez]

Fixes #22417

Not sure what to do about https://github.com/kubernetes/test-infra/blob/master/prow/spyglass/write-a-lens.md#sandboxing, will this change affect the ability to access the parent window?

/cc @BenTheElder

Signed-off-by: Federico Gimenez [email protected]

[k8s-ci-robot]

Hi @fgimenez. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[BenTheElder]

/ok-to-test

I'm not sure re: sandboxing, it's not my usual domain 😅

I'm also not sure who currently working in the project would know more.

[alvaroaleman]

We control what we put into the iframe so this should be fine. Not a frontend specialist though.
/assign @cjwagner
/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alvaroaleman, fgimenez

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• prow/OWNERS [alvaroaleman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cjwagner]

/assign @e-blackwelder
Could you please help review this PR, Ethan? I'm only vaguely familiar with how origin policies work and I don't feel comfortable approving without the eyes of a SME.

[BenTheElder]

will this change affect the ability to access the parent window?

no not the window.

[BenTheElder]

/hold cancel

[BenTheElder]

/lgtm
/test all

[Katharine]

Since I'm looking at this and thinking about it, noting this for anyone who cares:

Having both allow-scripts and allow-same-origin removes any security properties provided by the sandbox: allow-same-origin allows the frame to modify its parent, which enables it to remove the sandbox properties. This is probably not important right now, but may matter if you ever enable remote lenses.

The other perhaps-unintentional effect allow-same-origin has is enabling access to APIs not explicitly provided to lenses, potentially resulting in surprise maintenance burdens. As designed, this was not supposed to be permitted — though I can't speak to whether you still care.