HTML Service: Restrictions

  • Apps Script utilizes iframes to sandbox HTML service web apps and custom interfaces for Google products, protecting users from malicious code.

  • All sandbox modes except IFRAME are sunset; existing scripts using older modes automatically transition to IFRAME, and developers should migrate their code accordingly.

  • The IFRAME sandbox mode, based on HTML5 iframe sandboxing, imposes limitations on client-side code with specific allowances and restrictions.

  • To redirect users in IFRAME mode, use links or buttons with target="_top" or _blank" or utilize the <base> tag to override this behavior.

  • Active content like scripts and external stylesheets within the sandboxed environment must be loaded over HTTPS to ensure security.

To protect users from being served malicious HTML or JavaScript, Apps Script uses iframes to sandbox HTML-service web apps or custom user interfaces for Google Docs, Sheets, and Forms. (The HTML service does not use a sandbox in other situations, like generating the body of an email.) The sandbox imposes limitations on client-side code.

Sandbox Mode

All sandbox modes are now sunset except for IFRAME. Apps using older sandbox modes now use the newer IFRAME mode automatically. If you have scripts that were developed using the older modes (NATIVE and EMULATED), you should follow the migration instructions to ensure they function properly under the IFRAME mode.

The setSandboxMode method now has no effect when called.

Restrictions in IFRAME mode

The IFRAME sandbox mode is based on the iframe sandboxing feature in HTML5, using the following keywords:

  • allow-same-origin
  • allow-forms
  • allow-scripts
  • allow-popups
  • allow-downloads
  • allow-modals
  • allow-popups-to-escape-sandbox
  • allow-top-navigation-by-user-activation - This attribute is only set for stand-alone script projects.

The allow-top-navigation keyword, which allows the content to navigate its top-level browsing context, is restricted and not set as an attribute in the sandbox. If you need to redirect your script, add a link or a button for the user to take action on instead.

In the IFRAME mode you need to set the link target attribute to either _top or _blank:

Code.js

function doGet() {
  var template = HtmlService.createTemplateFromFile('top');
  return template.evaluate().setSandboxMode(HtmlService.SandboxMode.IFRAME);
}

top.html

<!DOCTYPE html>
<html>
 <body>
   <div>
     <a href="http://google.com" target="_top">Click Me!</a>
   </div>
 </body>
</html>

You can also override this attribute using the <base> tag within the head section of the enclosing web page:

<!DOCTYPE html>
<html>
  <head>
    <base target="_top">
  </head>
  <body>
   <div>
     <a href="http://google.com">Click Me!</a>
   </div>
 </body>
</html>

HTTPS required for active content

"Active" content like scripts, external stylesheets, and XmlHttpRequests must be loaded over HTTPS, not HTTP.