useIframeSandbox (JavaScript)

Summary

Rule available since: v2.4.12
Diagnostic Category: lint/security/useIframeSandbox
This rule isn’t recommended, so you need to enable it.
This rule doesn’t have a fix.
The default severity of this rule is error.
Sources:
- Inspired from react-dom/no-missing-iframe-sandbox
- Same as @eslint-react/dom-no-missing-iframe-sandbox
- Same as react/iframe-missing-sandbox

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "security": {
5
        "useIframeSandbox": "error"
6
      }
7
    }
8
  }
9
}

Description

Enforce the ‘sandbox’ attribute for ‘iframe’ elements.

The sandbox attribute enables an extra set of restrictions for the content in the iframe. Using the sandbox attribute is considered a good security practice.

See the Mozilla docs for details.

Examples

Invalid

1
function MyComponent() {
2
  return <iframe src="https://example.com" />;
3
}

code-block.jsx:2:10 lint/security/useIframeSandbox ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Iframe doesn't have the sandbox attribute.
  
    1 │ function MyComponent() {
  > 2 │   return <iframe src="https://example.com" />;
      │          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    3 │ }
    4 │ 
  
  ℹ The sandbox attribute enables an extra set of restrictions for the content in the iframe, protecting against malicious scripts and other security threats.
  
  ℹ Provide a sandbox attribute when using iframe elements.

Valid

1
function MyComponent() {
2
  return <iframe src="https://example.com" sandbox="allow-popups" />;
3
}