Extend iframe sandbox rules

core/src/services/iframe.js

@@ -5,8 +5,7 @@ import {
   IframeHelpers,
   RoutingHelpers
 } from '../utilities/helpers';
-import { LuigiConfig } from '../core-api';
-import { LuigiI18N } from '../core-api';
+import { LuigiConfig, LuigiI18N } from '../core-api';
 
 class IframeClass {
   constructor() {

core/src/utilities/helpers/iframe-helpers.js

@@ -1,6 +1,7 @@
-// Helper methods for 'iframe.js' file. They don't require any method from 'ifram.js` but are required by them.
+// Helper methods for 'iframe.js' file. They don't require any method from 'iframe.js` but are required by them.
 import { GenericHelpers } from './';
 import { Iframe } from '../../services';
+import { LuigiConfig } from '../../core-api';
 
 class IframeHelpersClass {
   get specialIframeTypes() {
@@ -182,7 +183,7 @@ class IframeHelpersClass {
   }
 
   createIframe(viewUrl, viewGroup, clientPermissions) {
-    const activeSandboxRules = [
+    const luigiDefaultSandboxRules = [
       'allow-forms', // Allows the resource to submit forms. If this keyword is not used, form submission is blocked.
       'allow-modals', // Lets the resource open modal windows.
       // 'allow-orientation-lock', // Lets the resource lock the screen orientation.
@@ -197,6 +198,12 @@ class IframeHelpersClass {
       // 'allow-top-navigation-by-user-activation', // Lets the resource navigate the top-level browsing context, but only if initiated by a user gesture.
       // 'allow-downloads-without-user-activation' // Allows for downloads to occur without a gesture from the user.
     ];
+    const customSandboxRules = LuigiConfig.getConfigValue(
+      'settings.customSandboxRules'
+    );
+    let activeSandboxRules = customSandboxRules
+      ? [...new Set([...luigiDefaultSandboxRules, ...customSandboxRules])]
+      : luigiDefaultSandboxRules;
 
     const iframe = document.createElement('iframe');
     iframe.src = viewUrl;

core/test/utilities/helpers/iframe-helpers.spec.js

@@ -10,6 +10,7 @@ import { LuigiConfig } from '../../../src/core-api';
 
 describe('Iframe-helpers', () => {
   let component;
+  let customSandboxRules = ['allow-scripts', 'rules1', 'rules2'];
 
   beforeEach(() => {
     let lastObj = {};
@@ -19,8 +20,7 @@ describe('Iframe-helpers', () => {
       },
       get: () => lastObj
     };
-
-    sinon.stub(LuigiConfig, 'getConfigValue');
+    sinon.stub(LuigiConfig, 'getConfigValue').returns(customSandboxRules);
   });
   afterEach(() => {
     if (document.createElement.restore) {
@@ -43,6 +43,14 @@ describe('Iframe-helpers', () => {
       assert.equal(iframe.src, 'http://luigi.url.de/');
       assert.equal(iframe.vg, 'ananas');
     });
+
+    it('createIframe with cutomrules', () => {
+      const iframe = IframeHelpers.createIframe('http://luigi.url.com/');
+      assert.equal(
+        iframe.sandbox,
+        'allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts rules1 rules2'
+      );
+    });
   });
 
   describe('canReuseIframe', () => {

docs/general-settings.md

@@ -18,7 +18,9 @@ settings: {
         return translatedText;
       }
     };
-  }
+  },
+  customSandboxRules=['allow-downloads-without-user-activation']
+
 }
 ```` 
 
@@ -42,3 +44,4 @@ If you don't specify any value for  **responsiveNavigation**, the buttons remain
     }
 ````
 > **NOTE:** You can translate Luigi internal messages by providing translation for [these keys](../core/src/utilities/defaultLuigiTranslationTable.js).
+* **customSandboxRules** is an array of custom rules for the content in the iframe. You can extend the [Luigi default sandbox rules](https://github.com/SAP/luigi/blob/af1deebb392dcec6490f72576e32eb5853a894bc/core/src/utilities/helpers/iframe-helpers.js#L140) by adding further rules.