I would like to know if the
src attribute of an
iframe is safe for user input ?
I found this question, but my doubt is that I tried the code provided in the answer and it doesn't do anything with the
sandbox="allow-scripts allow-same-origin" attribute.
I'm allowing user to post videos, doing so when the user post a link on the backend a get request is made to get the correct value in
However nothing is stopping OP to post a link to www.my-site-with-fake-meta-tag.com and try to do something funny.
So I could white list some domains, but it's an annoying process. Beside every site I checked uses an iframe src for user submitted content.