Closed gtwilliams03 closed 6 years ago
I have an application using this component which renders a PDF inside an IFRAME. This component seems to set the sandbox property (at least in Chrome) to be wide open:
sandbox
sandbox="allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts allow-top-navigation"
I had to remove this component and replace it with a basic HTML tag to get the PDF to render so I could set the sandbox attribute to be blank.</p> <p>Help?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/gtwilliams03"><img src="https://avatars.githubusercontent.com/u/1564628?v=4" />gtwilliams03</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>[Edit] This does allow setting the <code>sandbox</code> property to "something" but it does not allow the value to be empty. I question whether a blank sandbox value should be the default?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/robbestad"><img src="https://avatars.githubusercontent.com/u/1560743?v=4" />robbestad</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>Good idea, will implement!</p> <p>man. 24. sep. 2018 kl. 19:18 skrev gtwilliams03 <a href="mailto:notifications@github.com">notifications@github.com</a>:</p> <blockquote> <p>[Edit] This does allow setting the sandbox property to "something" but it does not allow the value to be empty. I question whether a blank sandbox value should be the default?</p> <p>— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <a href="https://github.com/svenanders/react-iframe/issues/35#issuecomment-424054627">https://github.com/svenanders/react-iframe/issues/35#issuecomment-424054627</a>, or mute the thread <a href="https://github.com/notifications/unsubscribe-auth/ABfQp4rdoYGl7ijzzh1IQ4WvYpfXamVMks5ueRP_gaJpZM4W3GBa">https://github.com/notifications/unsubscribe-auth/ABfQp4rdoYGl7ijzzh1IQ4WvYpfXamVMks5ueRP_gaJpZM4W3GBa</a> .</p> <p>-- Mvh, Sven Anders Robbestad <a href="https://www.robbestad.com">https://www.robbestad.com</a> <a href="http://www.robbestad.com/">http://www.robbestad.com/</a></p> </blockquote> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/gtwilliams03"><img src="https://avatars.githubusercontent.com/u/1564628?v=4" />gtwilliams03</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>I have run into issues displaying PDFs in an iframe with various plugins even with <code>sandbox=''</code> - so it might even be preferable to also support a <code>sandbox={false}</code> property (which does not render the sandbox property at all. I just ran into this yanking react-iframe out of a project and replacing it with basic <code><iframe></code> tags (I had to remove the sandbox property altogether from the basic HTML <code>iframe</code> tag).</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/robbestad"><img src="https://avatars.githubusercontent.com/u/1560743?v=4" />robbestad</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>Alright! Fixed in 1.3.2!</p> <p>tor. 27. sep. 2018 kl. 16:51 skrev gtwilliams03 <a href="mailto:notifications@github.com">notifications@github.com</a>:</p> <blockquote> <p>I have run into issues displaying PDFs in an iframe with various plugins even with sandbox='' - so it might even be preferable to also support a sandbox={false} property (which does not render the sandbox property at all. I just ran into this yanking react-iframe out of a project and replacing it with basic <iframe> tags (I had to remove the sandbox property altogether.</p> <p>— You are receiving this because you commented. Reply to this email directly, view it on GitHub <a href="https://github.com/svenanders/react-iframe/issues/35#issuecomment-425122566">https://github.com/svenanders/react-iframe/issues/35#issuecomment-425122566</a>, or mute the thread <a href="https://github.com/notifications/unsubscribe-auth/ABfQp0W_RiRFUhoYvpNby5xF0AEgIZtpks5ufOXYgaJpZM4W3GBa">https://github.com/notifications/unsubscribe-auth/ABfQp0W_RiRFUhoYvpNby5xF0AEgIZtpks5ufOXYgaJpZM4W3GBa</a> .</p> <p>-- Mvh, Sven Anders Robbestad <a href="http://www.robbestad.com">http://www.robbestad.com</a> <a href="http://twitter.com/#!/svenardocom">http://twitter.com/#!/svenardocom</a></p> </blockquote> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/ghost"><img src="https://avatars.githubusercontent.com/u/10137?v=4" />ghost</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>Thanks! I ran into this just this morning, found this issue, came back ten minutes later and it was fixed. Excellent work.</p> <p>FWIW, this also allows you to run flash, which was my hurdle.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/gtwilliams03"><img src="https://avatars.githubusercontent.com/u/1564628?v=4" />gtwilliams03</a> commented <strong> 6 years ago</strong> </div> <div class="markdown-body"> <p>I updated and all is well with me! Many, many thanks! </p> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>
I have an application using this component which renders a PDF inside an IFRAME. This component seems to set the
sandboxproperty (at least in Chrome) to be wide open:I had to remove this component and replace it with a basic HTML