react/iframe-missing-sandbox

Without sandbox, the page inside an iframe can run scripts, submit forms, open popups, and navigate your page away. sandbox="" turns all of that off, and each allow-* word turns one thing back on.

The rule reports:

• an iframe that has no sandbox attribute
• a word in sandbox that isn't a known permission, such as a typo
• allow-scripts together with allow-same-origin. With both, a page from your own origin can remove the sandbox attribute from its own iframe.

It checks <iframe> and React.createElement("iframe", ...). It skips a value that isn't a string literal, such as sandbox={permissions}.

Configure#

Off by default. To turn it on:

[lint.rules]
"react/iframe-missing-sandbox" = "error" # or "warn"

Examples#

Reported:

const map = <iframe src="https://maps.example.com" />;

const video = <iframe src="https://video.example.com" sandbox="allow-everything" />;

const widget = <iframe src="/widget" sandbox="allow-scripts allow-same-origin" />;

import React from "react";

const map = React.createElement("iframe", { src: "https://maps.example.com" });

Not reported:

const map = <iframe src="https://maps.example.com" sandbox="" />;

const video = <iframe src="https://video.example.com" sandbox="allow-scripts allow-popups" />;

const widget = <iframe src="/widget" sandbox={permissions} />;