2 files changed, 56 insertions, 9 deletions

diff --git a/src/components/script/dom/element.rs b/src/components/script/dom/element.rs
index be475bd1d85..0bb776628c9 100644
--- a/src/components/script/dom/element.rs
+++ b/src/components/script/dom/element.rs
@@ -139,9 +139,9 @@ impl<'self> Element {
         return None;
     }
 
-    pub fn set_attr(&mut self, name: &DOMString, value: &DOMString) {
-        let name = name.to_str();
-        let value_cell = Cell::new(value.to_str());
+    pub fn set_attr(&mut self, raw_name: &DOMString, raw_value: &DOMString) {
+        let name = raw_name.to_str();
+        let value_cell = Cell::new(raw_value.to_str());
         let mut found = false;
         for attr in self.attrs.mut_iter() {
             if eq_slice(attr.name, name) {
@@ -158,7 +158,15 @@ impl<'self> Element {
             self.style_attribute = Some(
                 Stylesheet::from_attribute(
                     FromStr::from_str("http://www.example.com/").unwrap(),
-                    value.get_ref()));
+                    raw_value.get_ref()));
+        }
+
+        //XXXjdm We really need something like a vtable so we can call AfterSetAttr.
+        //       This hardcoding is awful.
+        if self.parent.abstract.unwrap().is_iframe_element() {
+            do self.parent.abstract.unwrap().with_mut_iframe_element |iframe| {
+                iframe.AfterSetAttr(raw_name, raw_value);
+            }
         }
 
         match self.parent.owner_doc {
diff --git a/src/components/script/dom/htmliframeelement.rs b/src/components/script/dom/htmliframeelement.rs
index 288a988928a..4c45e570b54 100644
--- a/src/components/script/dom/htmliframeelement.rs
+++ b/src/components/script/dom/htmliframeelement.rs
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-use dom::bindings::utils::{DOMString, null_string, ErrorResult};
+use dom::bindings::utils::{DOMString, null_string, ErrorResult, str};
 use dom::document::AbstractDocument;
 use dom::htmlelement::HTMLElement;
 use dom::windowproxy::WindowProxy;
@@ -11,14 +11,26 @@ use geom::rect::Rect;
 
 use servo_msg::constellation_msg::{ConstellationChan, FrameRectMsg, PipelineId, SubpageId};
 
+use std::ascii::StrAsciiExt;
 use std::comm::ChanOne;
 use extra::url::Url;
 use std::util::replace;
 
+enum SandboxAllowance {
+    AllowNothing = 0x00,
+    AllowSameOrigin = 0x01,
+    AllowTopNavigation = 0x02,
+    AllowForms = 0x04,
+    AllowScripts = 0x08,
+    AllowPointerLock = 0x10,
+    AllowPopups = 0x20
+}
+
 pub struct HTMLIFrameElement {
     parent: HTMLElement,
     frame: Option<Url>,
     size: Option<IFrameSize>,
+    sandbox: Option<u8>
 }
 
 struct IFrameSize {
@@ -39,6 +51,11 @@ impl IFrameSize {
     }
 }
 
+impl HTMLIFrameElement {
+    pub fn is_sandboxed(&self) -> bool {
+        self.sandbox.is_some()
+    }
+}
 
 impl HTMLIFrameElement {
     pub fn Src(&self) -> DOMString {
@@ -63,10 +80,32 @@ impl HTMLIFrameElement {
     }
 
     pub fn Sandbox(&self) -> DOMString {
-        null_string
-    }
-
-    pub fn SetSandbox(&self, _sandbox: &DOMString) {
+        self.parent.parent.GetAttribute(&str(~"sandbox"))
+    }
+
+    pub fn SetSandbox(&mut self, sandbox: &DOMString) {
+        let mut rv = Ok(());
+        self.parent.parent.SetAttribute(&str(~"sandbox"), sandbox, &mut rv);
+    }
+
+    pub fn AfterSetAttr(&mut self, name: &DOMString, value: &DOMString) {
+        let name = name.to_str();
+        if "sandbox" == name {
+            let mut modes = AllowNothing as u8;
+            let words = value.to_str();
+            for word in words.split_iter(' ') {
+                modes |= match word.to_ascii_lower().as_slice() {
+                    "allow-same-origin" => AllowSameOrigin,
+                    "allow-forms" => AllowForms,
+                    "allow-pointer-lock" => AllowPointerLock,
+                    "allow-popups" => AllowPopups,
+                    "allow-scripts" => AllowScripts,
+                    "allow-top-navigation" => AllowTopNavigation,
+                    _ => AllowNothing
+                } as u8;
+            }
+            self.sandbox = Some(modes);
+        }
     }
 
     pub fn AllowFullscreen(&self) -> bool {