CKEditor 4.21: The attribute sandbox is added automatically to iframes
Description
Attachments
- 17 Sep 2023, 05:08 PM
- 16 Sep 2023, 07:02 PM
- 13 Sep 2023, 02:11 PM
is related to
Activity
Bonnie Powers November 1, 2023 at 2:09 PM
Thanks, Sam.
Sam Ottenhoff October 31, 2023 at 9:47 PM
The sandbox attribute on an iframe is intended to provide greater security for end-users by limiting the capabilities of the iframe (e.g., putting it in a sandbox). It’s not “broken” in CKEditor. LMS power users often want the ability to embed rich content from other sites. It’s difficult for all external sites to keep up with browser changes and many of these sites may not yet work in an iframe sandbox.
As always, please clear your browser cache before testing updated JS code.
Bonnie Powers October 31, 2023 at 4:09 PM
Thanks Miguel. I see that it is CKEditor issue. I wonder if it is fixed in version 5 of CkEditor. We also updated to the latest 22.x update overnight and it did not fix the sandbox problem.
Miguel Pellicer October 31, 2023 at 7:28 AM
@Bonnie Powers I’m sorry you had issues with the sandbox attribute, I’d like to mention that the behavior was introduced by the CkEditor upgrade and it was unintended, the previous CkEditor version is affected by several security vulnerabilities and fixing them added this behavior. Once we identified the issue we provided a fix for it.
Sam Ottenhoff October 30, 2023 at 8:09 PM
Yes, feel free to test on trunk, 23.x, or 22.x.
Details
Details
Priority
Critical
CKEditor4.21 includes a security change related to iframes.
https://ckeditor.com/cke4/release/CKEditor-4.21.0
When an iframe is inserted in Sakai via the CKEditor, and the user switches between HTML code an the WYSIWYG, the ‘sandbox’ attribute is appended automatically to the object.
You can see the behavior in a a QA server, the following recording shows how the attribute is added automatically event after deleting it:
The sandbox attribute should be permitted, but not added automatically.
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP