Is it safe to have sandbox=“allow-scripts allow-po

问题:

I'm dynamically creating an iframe in my app, result looks as follows:

<iframe src="blob:http%3A//localhost%3A9292/0194dfed-6255-4029-a767-c60156f3d359" 
        scrolling="no" sandbox="allow-scripts allow-popups allow-same-origin" 
        name="sandbox" style="width: 100%; height: 100%; border: 0px;"></iframe>

Is it safe to have such sandbox configuration (especially allowing the iframe content to be treated as being from the same origin)?

回答1:

allow-same-origin is not safe. That will give the iframe the possibility to access parent data (also local storage for example)

Also allow-same-origin will allow the iframe to make ajax requests to the parent's apis which can also be harmful.

However, for an iframe to access parent's data, it also requires to execute scripts, so allow-same-origin without allow-scripts is harmless

As for the allow-popups, there is not much unsafe stuff an iframe can do, except the fact that it can open other urls

回答2:

As commented by Namey, allow-same-origin will not allow the iframe to be treated as the from same origin as the parent and is safe to use (unless the parent and the iframe share the same origin, cf: warning on MDN).

As described by https://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/#granular-control-over-capabilities:

The framed document is loaded into a unique origin, which means that all same-origin checks will fail; unique origins match no other origins ever, not even themselves. Among other impacts, this means that the document has no access to data stored in any origin’s cookies or any other storage mechanisms (DOM storage, Indexed DB, etc.).