From 4729c6bfd5f6ce5b1f497d298995d64ac0c3e979 Mon Sep 17 00:00:00 2001
From: NDevTK <31563761+NDevTK@users.noreply.github.com>
Date: Wed, 24 Apr 2024 00:10:04 +0100
Subject: [PATCH] Add comment instead of more code

---
 content/docs/attacks/navigations.md | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/content/docs/attacks/navigations.md b/content/docs/attacks/navigations.md
index cd71dce63..01cc7fd3f 100644
--- a/content/docs/attacks/navigations.md
+++ b/content/docs/attacks/navigations.md
@@ -35,7 +35,7 @@ To detect if any kind of navigation occurred, an attacker can:
 
 When an endpoint sets the [`Content-Disposition: attachment`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition) header, it instructs the browser to download the response as an attachment instead of navigating to it. Detecting if this behavior occurred might allow attackers to leak private information if the outcome depends on the state of the victim's account.
 
-### Download Navigation (without Lax cookies)
+### Download Navigation (with iframes)
 
 Another way to test for the [`Content-Disposition: attachment`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition) header is to check if a navigation occurred. If a page load causes a download, it does not trigger a navigation and the window stays within the same origin. [Run demo](https://xsinator.com/testing.html#Download%20Detection)
 
@@ -47,7 +47,8 @@ var url = 'https://example.org/';
 // Create an outer iframe to measure onload event
 var iframe = document.createElement('iframe');
 // Don't actually download the file to be stealthy
-iframe.sandbox = 'allow-scripts allow-same-origin';
+// Using window.open from this sandbox will also not download the file.
+iframe.sandbox = 'allow-scripts allow-same-origin allow-popups';
 document.body.appendChild(iframe);
 // Create an inner iframe to test for the download attempt
 iframe.srcdoc = `<iframe src="${url}" ></iframe>`;
@@ -71,7 +72,7 @@ When there is no navigation inside an `iframe` caused by a download attempt, the
 This attack works regardless of any [Framing Protections]({{< ref "xfo" >}}), because the `X-Frame-Options` and `Content-Security-Policy` headers are ignored if `Content-Disposition: attachment` is specified.
 {{< /hint >}}
 
-### Download Navigation (with Lax cookies)
+### Download Navigation (without iframes)
 
 A variation of the technique presented in the previous section can also be effectively tested using `window` objects:
 
@@ -79,14 +80,8 @@ A variation of the technique presented in the previous section can also be effec
 // Set the destination URL
 var url = 'https://example.org';
 
-// Don't actually download the file to be stealthy
-var iframe = document.createElement('iframe');
-iframe.sandbox = 'allow-scripts allow-same-origin allow-popups';
-document.body.appendChild(iframe);
-var openSandboxed = iframe.contentWindow.open;
-
 // Get a window reference
-var win = window.openSandboxed(url);
+var win = window.open(url);
 
 // Wait for the window to load.
 setTimeout(() => {