{"record":{"id":"da7586f00a61bad6","repo":"oxc-project/oxc","slug":"an-iframe-element-is-missing-a-sandbox-attribute","errorCode":null,"errorMessage":"An iframe element is missing a sandbox attribute","messagePattern":"An iframe element is missing a sandbox attribute","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"error","filePath":"crates/oxc_linter/src/rules/react/iframe_missing_sandbox.rs","lineNumber":21,"sourceCode":"    ast::{\n        Argument, Expression, JSXAttributeItem, JSXAttributeValue, JSXElementName, ObjectProperty,\n        ObjectPropertyKind, StringLiteral,\n    },\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::Span;\n\nuse crate::{\n    AstNode,\n    ast_util::is_method_call,\n    context::LintContext,\n    rule::Rule,\n    utils::{get_prop_value, has_jsx_prop_ignore_case, is_create_element_call},\n};\n\nfn missing_sandbox_prop(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"An iframe element is missing a sandbox attribute\")\n        .with_help(\"Add a `sandbox` attribute to the `iframe` element.\")\n        .with_label(span)\n}\n\nfn invalid_sandbox_prop(span: Span, value: &str) -> OxcDiagnostic {\n    OxcDiagnostic::warn(format!(\"An iframe element defines a sandbox attribute with invalid value: {value}\"))\n        .with_help(\"Check this link for the valid values of `sandbox` attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox.\")\n        .with_label(span)\n}\n\nfn invalid_sandbox_combination_prop(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"An `iframe` element defines a sandbox attribute with both allow-scripts and allow-same-origin which is invalid\")\n        .with_help(\"Remove `allow-scripts` or `allow-same-origin`.\")\n        .with_label(span)\n}\n\nconst ALLOWED_VALUES: [&str; 14] = [\n    \"downloads-without-user-activation\",","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/react/iframe_missing_sandbox.rs#L3-L39","documentation":"Raised by react/iframe_missing_sandbox when an `<iframe>` JSX element (or createElement('iframe') call) has no `sandbox` attribute. At the throw site the embedded frame runs with full privileges over the embedding page, exposing the app to framing attacks and malicious third-party content; the sandbox attribute is the mechanism to restrict it. run() checks each iframe element/call for the prop (case-insensitive) and reports the element span when absent.","triggerScenarios":"Thrown at crates/oxc_linter/src/rules/react/iframe_missing_sandbox.rs:21 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add a sandbox attribute listing only the permissions needed, e.g. sandbox=\"allow-scripts\".","Remove embedded content if sandboxing is not feasible for the use case."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}