I am using an iFrame to contain an external html source .html

<iframe src=“.html" scrolling="no" style="overflow: hidden; height: 700px;"></iframe>

But good/main.html imports and executes the following javascript

.js
.js
.js

Is there a way to prevent good/main.html importing and executing bad/c.js? More specifically, prevent any resource that does not have the same domain as ?

I tried sandboxing the iFrame

<iframe sandbox=“allow-same-origin allow-scripts” src=“.html” scrolling="no" style="overflow: hidden; height: 700px;"></iframe>

But it still imports and executes the .js

Is there a way to prevent the source from importing and executing any external js?

I read about CSPs on iFrames, but I am unsure of it’s usage.

I am using an iFrame to contain an external html source https://good./main.html

<iframe src=“https://good./main.html" scrolling="no" style="overflow: hidden; height: 700px;"></iframe>

But good./main.html imports and executes the following javascript

https://good./a.js
https://good./b.js
https://bad./c.js

Is there a way to prevent good./main.html importing and executing bad./c.js? More specifically, prevent any resource that does not have the same domain as https://good.?

I tried sandboxing the iFrame

<iframe sandbox=“allow-same-origin allow-scripts” src=“https://good./main.html” scrolling="no" style="overflow: hidden; height: 700px;"></iframe>

But it still imports and executes the https://bad./c.js

Is there a way to prevent the source from importing and executing any external js?

I read about CSPs on iFrames, but I am unsure of it’s usage.

• javascript
• html
• css
• sandbox
• content-security-policy

1 Answer 1

Broadly speaking, you can't. Iframes have their own CSP and you can't pass a policy in from the parent page.

That said, the "csp" attribute of the iframe element, that you link to in the question, somewhat allows this. It allows you to request that the iframe source apply the CSP that you set in the "csp" attribute; but you can't enforce it, merely ask. So you can theoretically do:

<iframe csp="default-src 'none';" ...>

The source of the iframe may or may not implement the CSP you request.

Note this is brand new and is (reportedly) only supported in Chrome and Opera.