Follow-up to #19. For a frame absent from the DOM snapshot (out of process), the Iframe node carries properties.url, which is the raw src attribute:
- not resolved against the document base URL (DOMSnapshot already has
documentURL/baseURL per document), so a sandboxed same-origin src="/render?..." is handed over unopenable;
- not passed through credential redaction, so
?client_secret=... style embeds land in model context;
- the check is
tagName === 'IFRAME' on a non-ignored visit, so <frame>/<object>/<embed> documents and aria-hidden iframes are neither counted nor offered a URL, and case is not normalised the way untrusted.ts does.
Where: src/core/snapshot.ts (visit, the out-of-process branch), src/core/untrusted.ts.
Follow-up to #19. For a frame absent from the DOM snapshot (out of process), the Iframe node carries
properties.url, which is the rawsrcattribute:documentURL/baseURLper document), so a sandboxed same-originsrc="/render?..."is handed over unopenable;?client_secret=...style embeds land in model context;tagName === 'IFRAME'on a non-ignored visit, so<frame>/<object>/<embed>documents andaria-hiddeniframes are neither counted nor offered a URL, and case is not normalised the wayuntrusted.tsdoes.Where:
src/core/snapshot.ts(visit, the out-of-process branch),src/core/untrusted.ts.