Iframes in extension

Add-ons addons.mozilla.org
#1

Hi team,

we have submitted an extension. It’s UI fully depends on iframes. Because the reviewing team is unsure whether to support extensions which make use of iframes or not, it got rejected.

  1. Did you come to an conclusion whether you will or will not support extensions which use iframes? If not when will you have the final answer?

  2. If we already have an extension with iframes in the store. Are we able to push an update to this extension until this potential policy change becomes official?

Thank you very much,
Jean Pierre Gülcicek form comprigo.

#2

Generally, addons can have iframes but …

Remote iframes need to have a ‘sandbox’ attribute in order to prevent execution of remote code.
For more information see
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#Attributes

#3

@erosman, what about my second question?

  1. If we already have an extension with iframes in the store. Are we able to push an update to this extension until this potential policy change becomes official
#4

What kind of extension is it? Legacy, bootstrapped, SDK, WebExtension?
Has it been reviewed?
Why not add the ‘sandbox’ attribute?

#5

@erosman, it’s an SDK extension, that has already been reviewed with the implementation of iframes.
To ensure the best user experience possible we are heavily relying on this feature for maintenance reason. In case any bug appears we are able to provide a fix right away.
Would our existing extension with iframes pass the review if we set the sandbox attribute with our needed permissions (allow-forms, allow-scripts) ?

#6

There is not enough information to answer properly.
It depends on how iframe is loaded, what query strings are passed to it etc etc.

I would need to see the code.

#7

@erosman, this is the extension I am talking about: https://goo.gl/lNTfx8

#8

You addon has passed. Where is the iframe in question?