Skip to content

Add sandbox attribute to extension iframe in DevTools. #9967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnpryan wants to merge 3 commits into
base: master
Choose a base branch
from
+12 −1
Open

Add sandbox attribute to extension iframe in DevTools. #9967

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
11e2820
Add sandbox attribute to extension iframe in DevTools.
johnpryan Aug 18, 2026
0de5535
Add pull request URL
johnpryan Aug 18, 2026
7c5b804
Move string to top-level variable
johnpryan Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,14 @@ String _debugExtensionPlaceholderHtml(String name) {
''';
}

/// The sandbox permissions granted to embedded extension iframes.
///
/// Restricts the extension from accessing same-origin resources such as
/// the parent window DOM, cookies, or local storage, while allowing
/// javascript execution, forms, downloads, and popup windows.
const _extensionSandboxRules =
'allow-scripts allow-forms allow-downloads allow-popups allow-popups-to-escape-sandbox';

class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController
with AutoDisposeControllerMixin {
EmbeddedExtensionControllerImpl(super.extensionConfig);
Expand Down Expand Up @@ -123,7 +131,8 @@ class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController
// This url is safe because we built it ourselves and it does not include
// any user input.
..src = extensionUrl
..allow = 'usb';
..allow = 'usb'
..sandbox.value = _extensionSandboxRules;
_extensionIFrame.style
..border = 'none'
..height = '100%'
Expand Down
2 changes: 2 additions & 0 deletions packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,8 @@ TODO: Remove this section if there are not any updates.

* Hide the DevTools extensions menu button in single-screen embedded mode (`EmbedMode.embedOne`) on standard screens.
[#8507](https://github.com/flutter/devtools/issues/8507)
* Added iframe sandboxing for embedded DevTools extensions to enforce origin
isolation. [#9967](https://github.com/flutter/devtools/pull/9967)

## Advanced developer mode updates

Expand Down
Loading