HTML Service: Restrictions (original) (raw)

HTML Service: Restrictions

Stay organized with collections Save and categorize content based on your preferences.

To protect users from being served malicious HTML or JavaScript, Apps Script uses iframes to sandbox HTML-service web apps or custom user interfaces for Google Docs, Sheets, and Forms. (The HTML service does not use a sandbox in other situations, like generating the body of an email.) The sandbox imposes limitations on client-side code.

Sandbox Mode

All sandbox modes are now sunset except for IFRAME. Apps using older sandbox modes now use the newer IFRAME mode automatically. If you have scripts that were developed using the older modes (NATIVE and EMULATED), you should follow the migration instructions to ensure they function properly under the IFRAME mode.

The setSandboxModemethod now has no effect when called.

Restrictions in IFRAME mode

The IFRAME sandbox mode is based on theiframe sandboxing feature in HTML5, using the following keywords:

allow-same-origin
allow-forms
allow-scripts
allow-popups
allow-downloads
allow-modals
allow-popups-to-escape-sandbox
allow-top-navigation-by-user-activation - This attribute is only set forstand-alone script projects.

The allow-top-navigation keyword, which allows the content to navigate its top-level browsing context, is restricted and not set as an attribute in the sandbox. If you need to redirect your script, add a link or a button for the user to take action on instead.

Setting the link target attribute

In the IFRAME mode you need to set the link target attribute to either_top or _blank:

Code.js

function doGet() {
  var template = HtmlService.createTemplateFromFile('top');
  return template.evaluate().setSandboxMode(HtmlService.SandboxMode.IFRAME);
}

top.html

<!DOCTYPE html>
<html>
 <body>
   <div>
     <a href="http://google.com" target="_top">Click Me!</a>
   </div>
 </body>
</html>

You can also override this attribute using the <base> tag within the head section of the enclosing web page:

<!DOCTYPE html>
<html>
  <head>
    <base target="_top">
  </head>
  <body>
   <div>
     <a href="http://google.com">Click Me!</a>
   </div>
 </body>
</html>

HTTPS required for active content

"Active" contentlike scripts, external stylesheets, and XmlHttpRequests must be loaded over HTTPS, not HTTP.