Is it safe to have sandbox="allow-scripts allow-popups allow-same-origin" on <iframe />?

Question

I'm dynamically creating an iframe in my app, result looks as follows:

<iframe src="blob:http%3A//localhost%3A9292/0194dfed-6255-4029-a767-c60156f3d359" 
        scrolling="no" sandbox="allow-scripts allow-popups allow-same-origin" 
        name="sandbox" style="width: 100%; height: 100%; border: 0px;"></iframe>

Is it safe to have such sandbox configuration (especially allowing the iframe content to be treated as being from the same origin)?

Answer 1

allow-same-origin is not safe. That will give the iframe the possibility to access parent data (also local storage for example)

Also allow-same-origin will allow the iframe to make ajax requests to the parent's apis which can also be harmful.

However, for an iframe to access parent's data, it also requires to execute scripts, so allow-same-origin without allow-scripts is harmless

As for the allow-popups, there is not much unsafe stuff an iframe can do, except the fact that it can open other urls