Tweeted twitter.com/StackSecurity/status/850927124060008450
2 edited title
| link

is Is the src of an iframe safe for user input?

1
source | link

is the src of an iframe safe for user input?

<iframe sandbox="allow-scripts allow-same-origin"
  src="javascript:alert(1)">

I would like to know if the src attribute of an iframe is safe for user input ? I found this question, but my doubt is that I tried the code provided in the answer and it doesn't do anything with the sandbox="allow-scripts allow-same-origin" attribute.

I'm allowing user to post videos, doing so when the user post a link on the backend a get request is made to get the correct value in meta tag. However nothing is stopping OP to post a link to www.my-site-with-fake-meta-tag.com and try to do something funny.

So I could white list some domains, but it's an annoying process. Beside every site I checked uses an iframe src for user submitted content.