From bc1f799c44b77d8ed4e945b1ac29607e7abd58a2 Mon Sep 17 00:00:00 2001
From: John Factotum <50942278+johnfactotum@users.noreply.github.com>
Date: Thu, 30 Mar 2023 16:21:28 +0800
Subject: [PATCH] FXL: sandbox the iframes

---
 fixed-layout.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fixed-layout.js b/fixed-layout.js
index d39c010..75c8d2f 100644
--- a/fixed-layout.js
+++ b/fixed-layout.js
@@ -63,6 +63,9 @@ class Container {
             display: 'none',
             overflow: 'hidden',
         })
+        // `allow-scripts` is needed for events because of WebKit bug
+        // https://bugs.webkit.org/show_bug.cgi?id=218086
+        iframe.setAttribute('sandbox', 'allow-same-origin allow-scripts')
         iframe.setAttribute('scrolling', 'no')
         iframe.classList.add('filter')
         this.#element.append(element)