{"action":"created","issue":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/262","labels_url":"https://api.github.com/repos/brave/browser-laptop/issues/262/labels{/name}","comments_url":"https://api.github.com/repos/brave/browser-laptop/issues/262/comments","events_url":"https://api.github.com/repos/brave/browser-laptop/issues/262/events","html_url":"https://github.com/brave/browser-laptop/issues/262","id":128294234,"number":262,"title":"Add a sandbox attribute to the inserted iframes","user":{"login":"bbondy","id":831718,"avatar_url":"https://avatars.githubusercontent.com/u/831718?v=3","gravatar_id":"","url":"https://api.github.com/users/bbondy","html_url":"https://github.com/bbondy","followers_url":"https://api.github.com/users/bbondy/followers","following_url":"https://api.github.com/users/bbondy/following{/other_user}","gists_url":"https://api.github.com/users/bbondy/gists{/gist_id}","starred_url":"https://api.github.com/users/bbondy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbondy/subscriptions","organizations_url":"https://api.github.com/users/bbondy/orgs","repos_url":"https://api.github.com/users/bbondy/repos","events_url":"https://api.github.com/users/bbondy/events{/privacy}","received_events_url":"https://api.github.com/users/bbondy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/brave/browser-laptop/labels/security","name":"security","color":"eb6420"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-01-23T03:31:41Z","updated_at":"2016-01-23T20:18:32Z","closed_at":"2016-01-23T06:13:26Z","body":"Wladimir Palant on January 20, 2016 at 13:51:08 says:\r\nHm, safe ads... You know that an iframe with srcdoc attribute is considered first-party and the same-origin policy isn't stopping it from accessing its parent? So, unless you also add a sandbox attribute, the ad frames you are injecting are just as unsafe as the ones you blocked. Want to actually sandbox them?\r\n\r\nFor reference, I'm talking about this code: https://github.com/brave/browser-laptop/blob/e008a788c9d6256d04897bb5725a6018e68ea493/app/content/webviewPreload.js#L110"},"comment":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/comments/174217662","html_url":"https://github.com/brave/browser-laptop/issues/262#issuecomment-174217662","issue_url":"https://api.github.com/repos/brave/browser-laptop/issues/262","id":174217662,"user":{"login":"bbondy","id":831718,"avatar_url":"https://avatars.githubusercontent.com/u/831718?v=3","gravatar_id":"","url":"https://api.github.com/users/bbondy","html_url":"https://github.com/bbondy","followers_url":"https://api.github.com/users/bbondy/followers","following_url":"https://api.github.com/users/bbondy/following{/other_user}","gists_url":"https://api.github.com/users/bbondy/gists{/gist_id}","starred_url":"https://api.github.com/users/bbondy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbondy/subscriptions","organizations_url":"https://api.github.com/users/bbondy/orgs","repos_url":"https://api.github.com/users/bbondy/repos","events_url":"https://api.github.com/users/bbondy/events{/privacy}","received_events_url":"https://api.github.com/users/bbondy/received_events","type":"User","site_admin":false},"created_at":"2016-01-23T20:18:32Z","updated_at":"2016-01-23T20:18:32Z","body":"cc @SergeyZhukovsky, please fix also when you get a chance in the Brave branch."}}