From a917882894e33c5f9212207d5d76e4e109d62853 Mon Sep 17 00:00:00 2001
From: Albert Li <wentaoli@microsoft.com>
Date: Fri, 28 Aug 2026 20:07:11 +0800
Subject: [PATCH] Add iframe attributes for allow and sandbox configurations
 before insertion

---
 src/embed.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/embed.ts b/src/embed.ts
index ef27eaad..61f24068 100644
--- a/src/embed.ts
+++ b/src/embed.ts
@@ -750,6 +750,17 @@ export abstract class Embed {
       iframeContent.setAttribute("src", embedUrl);
       iframeContent.setAttribute("scrolling", "no");
       iframeContent.setAttribute("allowfullscreen", "true");
+
+      // Sandbox flags and the permissions-policy container are snapshotted when the frame is
+      // inserted, so these must be set before appendChild to affect the document that loads.
+      if (this.config.iframeAllow) {
+        iframeContent.setAttribute("allow", this.config.iframeAllow);
+      }
+
+      if (this.config.iframeSandbox) {
+        iframeContent.setAttribute("sandbox", this.config.iframeSandbox);
+      }
+
       const node = this.element;
       while (node.firstChild) {
         node.removeChild(node.firstChild);