沙箱属性在iframe中限制了什么？
我一直在考虑使用iframe运行HTML代码（使用CSS和JavaScript）。我知道JavaScript不能不安全运行，因此我被告知要查看sandbox属性。我已经看了一段时间了，没有什么真正说明所有sandbox属性实际上所做的事情。最接近的事情是这篇文章但这仍然没有说很多。
MDN，W3Schools和其他文档网站表示，它增加了限制以增强安全性，但我想更多地了解添加了哪些限制。这些限制是否使运行JavaScript代码安全？我需要在中包括＆lt; iframe＆gt;以运行JavaScript代码，无论如何，对吗？
我想将其用于编程帮助网站。 ＆lt; iframe＆gt;将用于运行用户编写的HTML代码（使用CSS和最终JavaScript）。因为这是我学士学位的高级项目，所以我也不需要也需要运行JavaScript，但这是一个加号。
一个澄清问题。如果我只是为了允许用户使用CSS运行HTML，我可以添加sandbox属性，可以很好，正确吗？因为sandbox没有允许 - 标记会阻止脚本运行，对吗？
I've been thinking about using an iframe to run HTML code (with CSS and JavaScript). I knew that JavaScript can't be unsafe to run, and so I was told to look into the sandbox attribute. I've been looking things up for quite a while, and nothing really says what all the sandbox attribute actually does. The closest thing was this article from Google Cloud, but that still doesn't say a ton.
MDN, W3Schools, and other documentation websites say that it adds restrictions to enhance security, but I want to understand a little more about what restrictions are added. And do these restrictions make it safe to run JavaScript code? I would need to include allow-scripts for an <iframe> to run JavaScript code anyways, right?
I am wanting to use this for a programming help website. The <iframe> will be used to run HTML code (with CSS and hopefully eventually JavaScript) that the users write. Because this is for the Senior Project for my Bachelor's degree, I don't need it to run JavaScript as well, but it would be a plus.
A clarification question. If I were just to allow the users to run HTML with CSS, I could add the sandbox attribute, and would be fine, correct? Because sandbox without allow-scripts would block scripts from running, right?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论