Please add allow-forms to the iframe sandbox.

[bpmckee]

Currently the code output's iframe has sandbox="allow-scripts".

Can it be set to sandbox="allow-scripts allow-forms"? That way onSubmit will be called for a form element.

[bpmckee]

To add more detail, I want to do this.

import 'dart:html';

const form = querySelector('form');

void main() {
  form.onSubmit.listen((Event event) {
    event.preventDefault();
    print('Form submitted');
  });
}

<form>
  <button type="submit">Submit</button>
</form>

When I click the button, there's an error in the console (that I can't intercept). I can't tell when the form was supposed to be submitted.

[RedBrogdon]

That certainly seems like a reasonable request, though I'm not sure of the possible security concerns.

@devoncarew, do you happen to know if allow-forms was considered and rejected for a specific reason, or whether it was just lumped in with all the other permissions we've left off the iframe?

[devoncarew]

It wasn't considered specifically; we're using the min. set of permissions we can have and still allow us to execute the compiled JS.

I'd be conservative about adding more permissions.

[parlough]

Thanks for the suggestion!

The current DartPad UI has however dropped support for standalone HTML views, so the permission likely isn't as relevant anymore.

I'll close this as stale, but if anyone has a desire to still see this change, please open a new issue with details about your use case. Thanks again :)