13

I attempted to post the following code snippet using HTML5 local storage, but I receive:

Submit { "message": "Uncaught SecurityError: Failed to read the 'localStorage' property from 'Window': The document is sandboxed and lacks the 'allow-same-origin' flag.", "filename": "https://stacksnippets.net/js", "lineno": 27, "colno": 23 }

Here is the jsfiddle that works: http://jsfiddle.net/jvso1Lcc/22/

Below is the snippet:

function reload() {
 localStorage.setItem('selectedVal',$('#mySelect').val());
  location.reload(true);
}

$( document ).ready(function() {
    var selectedVal = localStorage.getItem('selectedVal');
    if (selectedVal){
       $('#mySelect').val(selectedVal)
    }

});
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

<select id='mySelect'>
 <option>One</option>
  <option>Two</option>
  <option>Three</option>
  <option>Four</option>
</select>
<button onclick="reload()">Submit</button>

16
  • 1
    This is not a bug, it's how JavaScript works in a sandboxed environment. Commented Mar 14, 2017 at 2:35
  • so how do I get away with it in jsfiddle is that not a sandboxed environment? Commented Mar 14, 2017 at 2:35
  • 1
    Because the <iframe> on JSFiddle has the allow-same-origin flag in the sandbox attribute. Commented Mar 14, 2017 at 2:37
  • could SO do the same? Commented Mar 14, 2017 at 2:38
  • You might want to wait on accepting an answer I'm not entirely sure if the reasoning for it not being allowed that I gave is correct.
    – Jason C
    Commented Mar 14, 2017 at 2:51
  • ok I unaccepted it. Commented Mar 14, 2017 at 3:10
  • @BryanDellinger I'd recommend reading Minus 100 points article that explains one approach to how in features are implemented. Your question is likely asking for opposite of what reality is - feature is not there because it is not implemented rather than taken away. Commented Mar 14, 2017 at 3:23
  • 2
    Here a dev mentions that it's by design but that they'd discuss it internally. The post links to a detailed explanation: "The framed document is loaded into a unique origin, which means that all same-origin checks will fail; unique origins match no other origins ever, not even themselves. Among other impacts, this means that the document has no access to data stored in any origin’s cookies or any other storage mechanisms (DOM storage, Indexed DB, etc.)."
    – user247702
    Commented Mar 14, 2017 at 8:57
  • 1
    I trust SO to run scripts on my machine. I don't trust you (generic you as in any poster not a personal thing). If I accidentally hit the button to run your code somehow, I want to minimize the ways you can attack my box. Truthfully I think the run snippet feature is a bad idea for security and ought to be removed, I will never purposely run a script from an unknown user. Commented Mar 15, 2017 at 0:51
  • @GabeSechan: so SO could have a warning on "Run Snippet"? We are here to fix code problems and we are advised to post code here in snippets instead of JSFiddle. The same fool that will allow malicious code to run when clicking "Run Snippet" will be fooled when directed to JSFiddle from SO.
    – mplungjan
    Commented May 21, 2017 at 7:15
  • @mplungjan Posting code is so you can read it. There's no way in hell I'm running code. Run snippet should be removed for security reasons, there is no good reason to have it. If someone really wants to run the code, they can copy paste it in their javascript console. But if for some reason I do click it by accident, I want the highest level of sandboxing possible. Commented May 21, 2017 at 7:27
  • Or have an option for butterfingers to remove the run snippet. I have no problems except when I try to help people and am blocked from doing so
    – mplungjan
    Commented May 21, 2017 at 7:38
  • @GabeSechan and how would one "accidently" press "Run code snippet" button? Paranoid people can easily hide the button with adblock extensions that they already are using.
    – vanowm
    Commented Aug 21, 2022 at 1:24
  • @vanowm You never accidentally click on things? Especially on mobile, where I rarely manage to hit the right link in a list, about 30% of the time I hit the one above or below. I don't think a day goes by when I don't accidentally click on something. I have never correctly clicked on a reddit link on mobile without zooming in. And I'm not wasting my time to adblock remove anything. Not to mention its a lawsuit waiting to happen- if my machine becomes compromised due to code hosted on a site, I am contacting my lawyer. Commented Aug 21, 2022 at 1:25
  • I don't recall ever accidently clicking giant "Run code snippet" button, even on mobile...
    – vanowm
    Commented Aug 21, 2022 at 1:29

1 Answer 1

7

To use local storage requires allow-same-origin.

(I'm not sure at all if the rest of this answer is correct.)

But allow-same-origin combined with the also necessary allow-scripts creates a security risk, as detailed here:

When the embedded document has the same origin as the main page, it is strongly discouraged to use both allow-scripts and allow-same-origin at the same time, as that allows the embedded document to programmatically remove the sandbox attribute. Although it is accepted, this case is no more secure than not using the sandbox attribute.

I'm sure it also introduces many other vulnerabilities, although I don't know much about the topic.

So that won't be happening.

JSFiddle has much looser sandboxing restrictions and takes a more open approach that is appropriate for a site like JSFiddle but not for a site like SO.

3
  • I don't think that warning would apply here: the embedded document is on a different origin (stacksnippets.net) than the main page (stackoverflow.com).
    – Jeremy Banks StaffMod
    Commented Mar 14, 2017 at 2:43
  • @JeremyBanks The snippets are hosted from that domain, but from looking at the HTML for the snippet on this page, there doesn't appear to be an "embedded document" other than that one <iframe> for the snippet code. Commented Mar 14, 2017 at 2:59
  • 7
    Can SO not just have a warning on "Run Snippet"? We are here to fix code problems and we are advised to post code here in snippets instead of JSFiddle. The same fool that will allow malicious code to run when clicking "Run Snippet" will be fooled when directed to JSFiddle from SO.
    – mplungjan
    Commented May 21, 2017 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .