Make iframe sandboxed by default

[zcbenz]

See #193 (comment).

[ptoomey3]

Thanks @zcbenz. Regular iframe security will generally be sufficient if Atom ends up iframing third-party content that is not sourced from the user's machine (ex. <iframe src='http://www.google.com'></iframe>), since standard same origin restrictions will apply. But, the sandbox attribute is useful for any iframe content that comes from the same origin. For example, if someone were to iframe a locally generated file such as rendered_output.html via <iframe src='rendered_output.html'></iframe> this would come from the same origin as Atom itself (file://). As a result, the iframe content could do window.parent.process to access Node. So, I think is a reasonable protection to just sandbox all iframes to be safe. I just tried this out by manually inserting an iframe with content from a local file into Atom. When I set sandbox = 'allow-scripts' (I had to enable scripting to even attempt outer frame access) the inner frame is still prevented from accessing the outer frame:

So, sandboxing seems a nice addition. Thanks for being so quick to respond @zcbenz!

/cc @mastahyeti @gregose

[ptoomey3]

Once we have this iframe protection in place (and CSP is working) it sounds like @probablycorey and @nathansobo were interested in doing another release.

[nathansobo]

To clarify, we'll handle CSP on our end.