no-missing-iframe-sandbox

Full Name in eslint-plugin-react-dom

react-dom/no-missing-iframe-sandbox

Full Name in @eslint-react/eslint-plugin

@eslint-react/dom-no-missing-iframe-sandbox

Features

🔧

Presets

strict strict-typescript strict-type-checked

Rule Details

The sandbox attribute enables an extra set of restrictions for the content in the iframe. Using the sandbox attribute is considered a good security practice.

Examples

Rendering an <iframe> without a sandbox attribute

An iframe without sandbox allows the embedded content unrestricted capabilities, which is a security risk.

// Problem: missing sandbox attribute leaves the iframe unrestricted.
function MyComponent() {
  return <iframe src="https://eslint-react.xyz" />;
  //     ^^^ Missing 'sandbox' attribute on iframe component.
}

// Recommended: add a sandbox attribute to restrict the iframe's capabilities.
function MyComponent() {
  return <iframe src="https://eslint-react.xyz" sandbox="allow-popups" />;
}

Versions

Resources

• Rule Source
• Test Source
• Rule Changelog

Further Reading

• MDN: iframe sandbox

See Also

• react-dom/no-missing-button-type
  Enforces an explicit type attribute for button elements.
• react-dom/no-unsafe-iframe-sandbox
  Enforces that the sandbox attribute for iframe elements is not set to unsafe combinations.