How to make allow-scripts and allow-same-origin coexist in iframe?

1
votes

So i just want to sandbox one html file in iframe and it works as long as there is just allow-scripts attribute, but as soon as I add allow-same-origin it stops to work because of this:

Notes about sandboxing: When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all. Sandboxing is useless if the attacker can display content outside a sandboxed iframe — such as if the viewer opens the frame in a new tab. Such content should be also served from a separate origin to limit potential damage. The sandbox attribute is unsupported in Internet Explorer 9 and earlier.From:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe

Code of iframe:

<iframe src="index.html" sandbox='allow-scripts allow-same-origin'></frame>

I want allow-same-origin because I want to use same css in iframe as is in index.html.

1
htmliframefirefox-addonsandboxfirefox-addon-webextensions
I understand, but is there any other way to sandbox html file so that it keeps it's origin(css in this case)?@SLaks – Marko Žlender
sandbox has nothing to do with origin or CSS. – SLaks
HTML file: <!DOCTYPE html> <html lang="en" > <head> <title>Title</title> <script> ... </script> <link rel="stylesheet" href="style.css"> </head> <body> <p class="text-light" id="something">something</p> <button onclick="function1()" class="btn button- gradient">Listen</button> </body> </html> This is HTML file that is in src of iframe and if I do not add allow-scripts, button is not working, by the way it works in chrome flawlessly with sandbox in manifest file. @SLaks – Marko Žlender
Is there another way to sandbox HTML file in this case @SLaks? – Marko Žlender
As the error explains, there is no point in sandboxing because you're granting permission to escape the sandbox. – SLaks

1 Answers

0
votes

Host the iframe on a different domain. This will keep the iframe secure when using sandbox="allow-scripts allow-same-origin".

But either way, CSS does NOT inherit in iframes. In fact, that's the whole purpose of iframes. And you can load the same CSS file in both pages, even without allow-same-origin set.