Block scripts in an embedded document.
HTML: An empty sandbox attribute applies the default set of restrictions, including blocking script execution.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Example</title>
</head>
<body>
<iframe title="Sandboxed preview" sandbox srcdoc="<p id="result">Unchanged</p><script>document.querySelector("#result").textContent="Changed";</script>"></iframe>
</body>
</html>Expected output EXAMPLE
The “#result” element displays “Unchanged”.
Details
Save as example.html and open in a modern browser. The output describes browser behavior verified with DOM and interaction assertions. An empty sandbox attribute applies the default set of restrictions, including blocking script execution.
Tested on Ubuntu 24.04.5 LTS · · Chromium 141.0.7390.37 · libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test inputs, results and environment
The exact published code ran in a dedicated Linux test container with prepared inputs. Unprivileged snippet process, external networking disabled, read-only root filesystem, and a fresh temporary working directory. Fixtures and output records are isolated from the application database. Testing covers this example and its stated checks, not every input, operating system, or runtime version. The Linux container shares its host's kernel; this is not a native Windows test.
- Architecture / host kernel
- x86_64 / 6.18.54.1-microsoft-standard-WSL2
- Snippet identity / locale
- uid=65534, gid=65534 (unprivileged) / C.UTF-8
- Interpreter invocation
Chromium: open example.html; execute the published browser assertions- Container image ID
sha256:32dc2d998158b6554c99b73b533f423696a0f3e31e8cbea9db10b5eee9a2fadd- Code SHA-256
c167c009a10bf43e6edea0abb12a2af4e0597bba6947dc1b636ce355cb6779bf- Dependencies
- libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test input setup
These are the prepared inputs used by the test harness. See Details above for the prerequisites and how to run this example.
# No input files required.
Observed standard output
Expected output describes the rendered page. The standard-output record below is the browser test harness receipt; the additional assertions check the result and interactions.
Block scripts in an embedded document: browser checks passed.
Exit code: 0. Standard error: empty. Validation: Shape/content assertions. System-dependent values above are one recorded run.
Additional assertions that passed
Checks recorded by the test harness. Where Python assertions are shown, browser cases use Playwright and simulator cases may inspect pin transitions: result.stdout is captured output, work is the temporary directory, and Path is pathlib.Path. The harness also imports json and csv.
assert await page.frame_locator('iframe').locator('#result').inner_text()=='Unchanged'