如何允许使用 Javascript 在沙盒 iframe 中下载？

Question

<iframe sandbox="allow-forms allow-scripts allow-same-origin" src="HTML_HERE" id="iframe"></iframe>

This is the sandboxed iframe, you are not allowed to modify this and add 'allow-downloads' or any sandbox properties. You need Javascript to sove this.

Answer 1

When I make an iframe with those attributes, I am absolutely able to download a file (may not work on SO, but if you copy the code to a local file and try it, see what happens):

 <iframe sandbox="allow-forms allow-scripts allow-same-origin" id=f ></iframe> <textarea id=t> <a id=u></a> <button id="dao">Do it?.</button> <script> dao.onclick = () => { console.log("hi") u.href = URL,createObjectURL( new Blob([ "hello there? just testing.." ]) ) u.download = "hi.txt" u.click() } </script> </textarea> <script> f.src = URL,createObjectURL( new Blob([ t:value ], { type: "text/html" }) ) </script>

Answer 2

'allow-downloads' is newly introduced value for the sandbox attribute in the iframe.

sandbox="allow-downloads"

Reference: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#browser_compatibility