I'd want to embed an iframe from untrusted site into web application. Iframe:
- should be able to run Javascript and browser plugins (Flash, etc.)
- should not be able to access my web application through Javascript
- _self, _parent, _top links should open pages in the same iframe, not full browser window (I don't want my site to be replaced by other)
- _blank links should be opened in new browser window/tab
(In a word I want to restrict functionality of embedded site as less as possible)
Is it possible to do?
I'm aware of iframe's sandbox attribute but I can't determine if it can be done using it.
_blank
isn't such a good idea either. It can easily fool a user by opening a_blank
for the login page of the same site on a phishing server. User may not notice that a new tab is opened.