218086 2020-10-22 09:59:25 -0700 Same domain sandboxed iframe events blocked from parent listener without allow-scripts 2025-02-09 04:50:33 -0800 1 1 1 Unclassified WebKit Frames Safari 14 All macOS 10.15 NEW InRadar P2 Normal --- 1 ccordry webkit-unassigned bfulgham opendarwin phil r89534217610 smoley webkit-bug-importer youennf oldest_to_newest 1700692 0 ccordry 2020-10-22 09:59:25 -0700 If a same domain iframe is created using `srcdoc` with `sandbox=allow-same-origin` and an event listener is created from the parent page e.g. const img = iframe.contentDocument.querySelector('img'); img.addEventListener('click', callback) The event will be blocked in Safari with the error `Blocked script execution in 'about:srcdoc' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.` In other modern browsers the event will be received by the parent page. Adding 'allow-scripts' will allow the parent to receive the event. We believe according to the spec https://html.spec.whatwg.org/multipage/webappapis.html#sandboxScriptBlocked these events should not be blocked as they execute in the parent window and not the sandboxed iframe window. You can find a demo at: https://sandboxed-listener.glitch.me/ 1700738 1 smoley 2020-10-22 10:55:29 -0700 Thanks for filing, I can reproduce this on Safari 12.1.2 as well as Safari Beta version 14.0.1 using the linked test case. 1700739 2 webkit-bug-importer 2020-10-22 10:55:45 -0700 <rdar://problem/70580282> 1726344 3 smoley 2021-02-05 18:06:30 -0800 *** Bug 221283 has been marked as a duplicate of this bug. *** 1886533 4 phil 2022-07-25 11:00:25 -0700 This bug also exists in Safari Version 15.5. This bug has a negative affect on web security because Safari's behavior means it's harder for developers to utilize sandboxed iframes to block scripts from within the iframe, if the external page still needs any scripting control. 2093280 5 r89534217610 2025-02-09 04:50:33 -0800 It is still present on the latest iOS and really undermines the security when working with iframes. Current workaround if you're using `srcdoc` is prepending CSP meta tag to block script executions: ```html <meta http-equiv="Content-Security-Policy" content="script-src 'none';"> ```