Bug: Admin live-preview iframe missing sandbox attribute — XSS escalation risk

[Siddh2024]

Summary

In public/admin.html line 428, the live preview <iframe> loads /me without a sandbox attribute. If /me is compromised (e.g., via stored XSS), an attacker gets full access to the admin panel's DOM, cookies, and localStorage.

Details

• File: public/admin.html line 428
• <iframe id="livePreviewIframe" ... src="/me" title="Live Profile Preview"></iframe>
• No sandbox attribute restricts what the iframe can do
• If the profile page has any XSS vulnerability, the attacker's script executes in the admin context

Impact

Privilege escalation via iframe — a stored XSS in a user profile becomes a full admin panel compromise.

Suggested Fix

Add sandbox="allow-scripts" to restrict iframe capabilities while still allowing preview rendering.

[aditya226-sharma]

/assign

[aditya226-sharma]

Hi! I've prepared a fix for this and opened PR #349 which is ready for review.

What it does:

• Adds sandbox="allow-scripts allow-same-origin" to the admin live-preview iframe
• Adds referrerpolicy="no-referrer" so the admin's origin isn't leaked to cross-origin resources

I had the fix ready before claiming, so I opened the PR directly rather than block on assignment — if this approach is fine, please assign the issue and review. Happy to adjust anything based on feedback.