noUnsafeIframeSandbox (JavaScript)

Summary

Diagnostic Category: lint/nursery/noUnsafeIframeSandbox
This rule doesn’t have a fix.
The default severity of this rule is error.
Sources:
- Same as react-dom/no-unsafe-iframe-sandbox
- Same as @eslint-react/dom-no-unsafe-iframe-sandbox

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUnsafeIframeSandbox": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow an unsafe combination of the sandbox attribute.

This rule reports cases where the attribute may contain allow-scripts and allow-same-origin at the same time, as this combination allows the embedded document to remove the sandbox attribute and bypass the restrictions.

See Play safely in sandboxed IFrames or this Stack Overflow answer for more details.

Examples

Invalid

1
function MyComponent() {
2
  return <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />;
3
}

code-block.jsx:2:44 lint/nursery/noUnsafeIframeSandbox ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Unsafe combination of allow-scripts and allow-same-origin in the sandbox attribute.
  
    1 │ function MyComponent() {
  > 2 │   return <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />;
      │                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    3 │ }
    4 │ 
  
  ℹ This lets the embedded document run scripts in the origin of the embedding page, so it can remove its own sandbox attribute and escape the restrictions.
  
  ℹ Remove allow-scripts or allow-same-origin from the sandbox attribute.
  
  ℹ See Play safely in sandboxed IFrames or this Stack Overflow answer for more details.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
function MyComponent() {
2
  return <iframe src="https://example.com" sandbox="allow-popups" />;
3
}