3
<iframe sandbox="allow-scripts allow-same-origin"
  src="javascript:alert(1)">

I would like to know if the src attribute of an iframe is safe for user input ? I found this question, but my doubt is that I tried the code provided in the answer and it doesn't do anything with the sandbox="allow-scripts allow-same-origin" attribute.

I'm allowing user to post videos, doing so when the user post a link on the backend a get request is made to get the correct value in meta tag. However nothing is stopping OP to post a link to www.my-site-with-fake-meta-tag.com and try to do something funny.

So I could white list some domains, but it's an annoying process. Beside every site I checked uses an iframe src for user submitted content.

  • Ban javascript: and data: urls and rely on same-origin more than sandbox. – dandavis Apr 6 '17 at 10:21
2

No, a user-supplied <iframe src=...> is not safe.

The alert() in your example doesn't fire because the sandbox property automatically blocks modal dialogs (alert boxes). But since you have set allow-scripts, the JS code is still executed in the background. And because allow-same-origin is set, it is even executed on the same domain as the embedding page. Using these settings together makes the sandbox attribute useless because you're giving the sandbox full privileges.

As a proof of concept, just use another function, e.g. document.write():

<iframe sandbox="allow-scripts allow-same-origin" src="javascript:document.write(document.domain)">

Or add the allow-modals directive (which interestingly isn't currently documented):

<iframe sandbox="allow-scripts allow-same-origin allow-modals" src="javascript:alert(1)">

Be aware that instead of the javascript: scheme an attacker could also inject a data: URI:

<iframe sandbox="allow-scripts allow-same-origin allow-modals" src="data:text/html,<script>alert(1)</script>">

If your plan was to give the embedded page as few permissions as possible, you could have just left the sandbox attribute empty:

<iframe sandbox src="...">
  • Would it be fine with a user supplied src for an iframe without any sandbox attribute at all? – Anders Apr 6 '17 at 8:21
  • @Anders Youtube requires allow-scripts and allow-same-origin for some reasons.. Anyway Virtually every site that has sharable content uses an iframe. Do they simply parse for XSS ? User submit link X, Server check meta tag to display thumbnail on user post, thumbnail displayed in iframe. – Ced Apr 6 '17 at 9:41
  • 1
    @Ced: you only need that relaxation for youtube if you want to interact with the video from the top page's JS – dandavis Apr 6 '17 at 10:22
  • @dandavis I'm not sure what you mean by interact with the video from the top page JS. jsfiddle.net/mzd7n53a if you remove either one of allow-scripts allow-same-origin, the video will simply not load. Even though the interaction is not with js. – Ced Apr 6 '17 at 10:53
  • @Ced That's because Youtube requires Javascript to run. If you trust YT, you can just leave out the sandbox attribute entirely. – Arminius Apr 6 '17 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.