oxc-project/oxc · error · OxcDiagnostic

An iframe element is missing a sandbox attribute

Error message

An iframe element is missing a sandbox attribute

What it means

Raised by react/iframe_missing_sandbox when an `<iframe>` JSX element (or createElement('iframe') call) has no `sandbox` attribute. At the throw site the embedded frame runs with full privileges over the embedding page, exposing the app to framing attacks and malicious third-party content; the sandbox attribute is the mechanism to restrict it. run() checks each iframe element/call for the prop (case-insensitive) and reports the element span when absent.

Source

Thrown at crates/oxc_linter/src/rules/react/iframe_missing_sandbox.rs:21

    ast::{
        Argument, Expression, JSXAttributeItem, JSXAttributeValue, JSXElementName, ObjectProperty,
        ObjectPropertyKind, StringLiteral,
    },
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_span::Span;

use crate::{
    AstNode,
    ast_util::is_method_call,
    context::LintContext,
    rule::Rule,
    utils::{get_prop_value, has_jsx_prop_ignore_case, is_create_element_call},
};

fn missing_sandbox_prop(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("An iframe element is missing a sandbox attribute")
        .with_help("Add a `sandbox` attribute to the `iframe` element.")
        .with_label(span)
}

fn invalid_sandbox_prop(span: Span, value: &str) -> OxcDiagnostic {
    OxcDiagnostic::warn(format!("An iframe element defines a sandbox attribute with invalid value: {value}"))
        .with_help("Check this link for the valid values of `sandbox` attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox.")
        .with_label(span)
}

fn invalid_sandbox_combination_prop(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("An `iframe` element defines a sandbox attribute with both allow-scripts and allow-same-origin which is invalid")
        .with_help("Remove `allow-scripts` or `allow-same-origin`.")
        .with_label(span)
}

const ALLOWED_VALUES: [&str; 14] = [
    "downloads-without-user-activation",

View on GitHub (pinned to e1e7af627c)

Solutions

1. Add a sandbox attribute listing only the permissions needed, e.g. sandbox="allow-scripts".
2. Remove embedded content if sandboxing is not feasible for the use case.

When it happens

Trigger: Thrown at crates/oxc_linter/src/rules/react/iframe_missing_sandbox.rs:21 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/da7586f00a61bad6. Report an issue: GitHub.