noUnsafeIframeSandbox (HTML)

Summary

Rule available since: v2.5.13
Diagnostic Category: lint/nursery/noUnsafeIframeSandbox
This rule doesn’t have a fix.
The default severity of this rule is error.
Sources:
- Inspired from react-dom/no-unsafe-iframe-sandbox
- Inspired from @eslint-react/dom-no-unsafe-iframe-sandbox

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUnsafeIframeSandbox": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow allow-scripts together with allow-same-origin in an iframe sandbox.

allow-scripts lets the embedded document run JavaScript, while allow-same-origin keeps its original security origin. For same-origin content, combining both permissions can let the embedded script remove the iframe’s sandbox attribute and escape its restrictions. Remove one of the two permissions.

See Play safely in sandboxed iframes for more details.

Examples

Invalid

1
<iframe src="https://example.com" sandbox="allow-scripts allow-same-origin"></iframe>

code-block.html:1:35 lint/nursery/noUnsafeIframeSandbox ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Unsafe combination of allow-scripts and allow-same-origin in the sandbox attribute.
  
  > 1 │ <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin"></iframe>
      │                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ This lets the embedded document run scripts in the origin of the embedding page, so it can remove its own sandbox attribute and escape the restrictions.
  
  ℹ Remove allow-scripts or allow-same-origin from the sandbox attribute.
  
  ℹ See Play safely in sandboxed IFrames or this Stack Overflow answer for more details.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
<iframe src="https://example.com" sandbox="allow-popups"></iframe>