== Why is this an issue?

HTML5 introduces the ability to restrict the permissions of content loaded into an ``++iframe++``. Simply adding the ``++sandbox++`` attribute to an ``++iframe++`` tag limits the ``++iframe++`` to simply loading the specified contents; no scripts will run, no popups will pop, and so on. You can re-enable additional functions individually by specifying them in the attribute's value:

* ``++allow-forms++`` - form submission
* ``++allow-popups++`` - popups
* ``++allow-scripts++`` - script execution
* ``++allow-pointer-lock++`` - access to the "pointer lock" API
* ``++allow-same-origin++`` - sandboxed content is marked as being from a different domain (even when it's not). This attribute turns that off so that, for instance, the ``++iframe++`` content can access its site's cookies.
* ``++allow-top-navigation++`` - turns the ``++target++`` attribute of ``++a++`` tags back on

Following the principle of minimum privileges, this rule raises an issue for each ``++iframe++`` which does not have a ``++sandbox++`` attribute.


=== Noncompliant code example

[source,html]
----
<iframe src="https://platform.twitter.com/widgets/tweet_button.html"
        style="border: 0; width:130px; height:20px;">  <!-- Noncompliant -->
</iframe>
----


=== Compliant solution

[source,html]
----
<iframe sandbox="allow-same-origin allow-scripts allow-popups allow-forms"
    src="https://platform.twitter.com/widgets/tweet_button.html"
    style="border: 0; width:130px; height:20px;">
</iframe>
----

== Resources

* OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* OWASP - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)[Top 10 2017 Category A7 - Cross-Site Scripting (XSS)]
* CWE - https://cwe.mitre.org/data/definitions/829[CWE-829 - Inclusion of Functionality from Untrusted Control Sphere]


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* Sandbox this "iframe".


'''
== Comments And Links
(visible only on this page)

=== on 15 Jul 2015, 13:53:48 Ann Campbell wrote:
\[~massimo.paladin] I've only got this rule marked for the security profile right now, but I'm very tempted to turn it on by default. What do you think?

endif::env-github,rspecator-view[]
