Add sandbox attribute to <object> element

[AmeliaBR]

Is there any reason that <object> (and <embed>) was not included when adding the sandbox attribute? There's a lot of text in the spec about restricting objects that are themselves in a sandboxed browsing context, but no way to specifically sandbox the object document or object plug-in.

My personal use case is for SVG objects. Although you can now embed SVG with <iframe> pretty much everywhere, the scaling and sizing is different than an <object> in most browsers, and is inconsistent from browser to browser. Right now, the only reasons I'd recommend using <iframe> for SVG are sandboxing and getting browsing-context names to work in IE/Edge.

[annevk]

@AmeliaBR it seems better to get to the bottom of those inconsistencies and fix those. Do you have web-platform-tests?

object and embed are extremely special in how they behave with respect to containing a browsing context, image, or plugin. Adding functionality on top of them would be ill-advised I think.

[AmeliaBR]

SVG is a special case because <iframe> is an option (minus the bugs). Of course, SVG is also a special case because all the sandbox attributes can be controlled by the browser.

However, even for Flash or PDF or other plug-in object, some of the sandbox restrictions (e.g., top-level navigation, pointer-lock, full-screen) could be enforced by the browser. It seems strange not to have that option, except by nesting the <object> inside a sandboxed <iframe>.

[annevk]

That would only make sense if folks are still investing in plugin architecture and if plugin architecture was standardized. Neither of those is the case so any such effort would be in vain.

[zcorpan]

I believe Flash does not support sandbox restrictions. So the only way to make sure Flash does not escape your sandbox is to disallow Flash from running in the first place.

Not sure what the situation is like for PDF.

[domenic]

Since we're looking to remove plugins and deprecate usage of object/embed (see #6003 and #4592), let's close this as not planned.