custom-html widget iframe allow more attributes

[JMach1]

The problem

Customer is using a widget with custom HTML code. The code of custom-html widget seems to end up in an iframe. The iframe seems to miss sandbox='allow-popups-to-escape-sandbox' which seems to stop the browser from opening up a link in a new tab. Also the code is provided inline which makes the browser think it doesn't have the same origin as the parent page, so customer can't use JavaScript to open a new page in the parent window either.

The solution

I've added following attributes:

allow-popups-to-escape-sandbox 
allow-top-navigation 
allow-presentation 
allow-orientation-lock 
allow-pointer-lock
allow-downloads 

I made it as a separate constant so it can be reused elsewhere, for example custom widget iframes.

[github-actions]

Accessibility Insights Action: All applicable checks passed

• URLs: 12 URL(s) passed, and 0 were not scannable
• Rules: 26 check(s) passed, and 26 were not applicable
• Download the Accessibility Insights artifact to view the detailed results of these checks

---

This scan used axe-core 4.3.2 with Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36.

[rafaeleloi]

@azaslonov @JMach1 could you please inform if is this already available? I’ve seen that the PR seems to have been merged into the master branch, does that mean it is released as well?

Do we need to do anything more than setting target=”_blank” on the links and then publish the portal?
Thanks.