Skip to content

Add sandbox attribute to extension iframe in DevTools. #9967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnpryan wants to merge 4 commits into
base: master
Choose a base branch
from
+12 −1
Open

Add sandbox attribute to extension iframe in DevTools. #9967

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
11e2820
Add sandbox attribute to extension iframe in DevTools.
johnpryan Aug 18, 2026
0de5535
Add pull request URL
johnpryan Aug 18, 2026
7c5b804
Move string to top-level variable
johnpryan Aug 18, 2026
c247ad8
Add allow-same-origin to DevTools extension iframe sandbox
johnpryan Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,9 @@ class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController
// This url is safe because we built it ourselves and it does not include
// any user input.
..src = extensionUrl
..allow = 'usb';
..allow = 'usb'
..sandbox.value =
'allow-scripts allow-forms allow-downloads allow-popups allow-popups-to-escape-sandbox';
Comment thread
johnpryan marked this conversation as resolved.
Outdated
_extensionIFrame.style
..border = 'none'
..height = '100%'
Expand Down
2 changes: 2 additions & 0 deletions packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,8 @@ TODO: Remove this section if there are not any updates.

* Hide the DevTools extensions menu button in single-screen embedded mode (`EmbedMode.embedOne`) on standard screens.
[#8507](https://github.com/flutter/devtools/issues/8507)
* Added iframe sandboxing for embedded DevTools extensions to enforce origin
isolation. [#9967](https://github.com/flutter/devtools/pull/9967)

## Advanced developer mode updates

Expand Down
Loading