useIframeSandbox (HTML)

Summary

Rule available since: v2.4.12
Diagnostic Category: lint/security/useIframeSandbox
This rule isn’t recommended, so you need to enable it.
This rule doesn’t have a fix.
The default severity of this rule is error.

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "security": {
5
        "useIframeSandbox": "error"
6
      }
7
    }
8
  }
9
}

Description

Require the sandbox attribute on <iframe> elements.

An iframe can run content from another document. The sandbox attribute restricts capabilities such as scripts, forms, navigation, and popups. An empty sandbox applies all restrictions; individual allow-* tokens restore only the capabilities the frame needs.

See MDN’s iframe sandbox reference.

Examples

Invalid

1
<iframe src="https://example.com"></iframe>

code-block.html:1:1 lint/security/useIframeSandbox ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Iframe doesn't have the sandbox attribute.
  
  > 1 │ <iframe src="https://example.com"></iframe>
      │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ The sandbox attribute enables an extra set of restrictions for the content in the iframe, protecting against malicious scripts and other security threats.
  
  ℹ Provide a sandbox attribute when using iframe elements.

Valid

1
<iframe src="https://example.com" sandbox="allow-popups"></iframe>