HTML5 introduces the ability to restrict the permissions of content loaded into an ``++iframe++``. Simply adding the ``++sandbox++`` attribute to an ``++iframe++`` tag limits the ``++iframe++`` to simply loading the specified contents; no scripts will run, no popups will pop, and so on. You can re-enable additional functions individually by specifying them in the attribute's value:

* ``++allow-forms++`` - form submission
* ``++allow-popups++`` - popups
* ``++allow-scripts++`` - script execution
* ``++allow-pointer-lock++`` - access to the "pointer lock" API
* ``++allow-same-origin++`` - sandboxed content is marked as being from a different domain (even when it's not). This attribute turns that off so that, for instance, the ``++iframe++`` content can access its site's cookies.
* ``++allow-top-navigation++`` - turns the ``++target++`` attribute of ``++a++`` tags back on

Following the principle of minimum privileges, this rule raises an issue for each ``++iframe++`` which does not have a ``++sandbox++`` attribute.


== Noncompliant Code Example

----
<iframe src="https://platform.twitter.com/widgets/tweet_button.html"
        style="border: 0; width:130px; height:20px;">  <!-- Noncompliant -->
</iframe>
----


== Compliant Solution

----
<iframe sandbox="allow-same-origin allow-scripts allow-popups allow-forms"
    src="https://platform.twitter.com/widgets/tweet_button.html"
    style="border: 0; width:130px; height:20px;">
</iframe>
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
* https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)[OWASP Top 10 2017 Category A7] - Cross-Site Scripting (XSS)



ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::comments-and-links.adoc[]
endif::env-github,rspecator-view[]
