{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "embedded-widget-trust-contract",
  "group": "embed",
  "title": [
    "Give an embedded widget a bounded trust contract",
    "嵌入组件，要先约定信任边界"
  ],
  "intro": [
    "A booking widget may need to resize its frame, but that is not a reason to accept arbitrary messages or unrestricted top-level navigation. Before commissioning an iframe integration, decide the exact capabilities, origins and message shapes required.",
    "预约组件可能需要调整框架高度，但这不能成为接收任意消息或任意跳转主页面的理由。委托iframe集成前，要明确能力、来源及消息结构。"
  ],
  "facts": [
    [
      "MDN describes iframe sandbox capability tokens and warns about same-origin allow-scripts plus allow-same-origin.",
      "MDN解释了iframe沙箱能力标记，并提示同源内容同时允许脚本与同源权限的风险。",
      "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe#sandbox"
    ],
    [
      "For postMessage, MDN advises exact target origins and validation of sender identity and received syntax.",
      "postMessage应指定准确目标来源，并核对发送者身份和消息结构。",
      "https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns"
    ]
  ],
  "columns": [
    [
      "Synthetic incoming message",
      "Contract check",
      "Result"
    ],
    [
      "合成收到的消息",
      "合同核对",
      "结果"
    ]
  ],
  "example": [
    [
      [
        "Origin https://booking.example.test; correct frame; {type:resize,height:640}",
        "Exact origin + source + integer height in 200–1200",
        "Accept bounded resize"
      ],
      [
        "准确预约测试域；正确框架；resize高度640",
        "准确来源、框架及200–1200整数高度",
        "接受有界调整"
      ]
    ],
    [
      [
        "Origin https://booking.example.test.attacker.test",
        "Suffix resembles vendor; exact origin differs",
        "Reject"
      ],
      [
        "来源域名仅前缀像供应商",
        "准确来源不符",
        "拒绝"
      ]
    ],
    [
      [
        "Correct origin; height:-1 or URL payload",
        "Message shape/range outside contract",
        "Reject; do not execute content"
      ],
      [
        "正确来源；高度-1或网址载荷",
        "结构或范围超出合同",
        "拒绝，不执行内容"
      ]
    ],
    [
      [
        "Correct origin; message from another frame",
        "Source is not expected window",
        "Reject"
      ],
      [
        "正确来源；来自另一框架",
        "不是约定窗口",
        "拒绝"
      ]
    ]
  ],
  "steps": [
    [
      "List necessary capabilities with the vendor and security owner. Prefer a separate trusted origin and review each sandbox exception; no token combination is a universal safe recipe.",
      "与供应商和安全负责人列必要能力，优先独立可信来源，逐项复核沙箱例外；没有通用安全标记组合。"
    ],
    [
      "Define a small typed protocol for resize or completion hints. Keep personal data and executable HTML out; a completion message must not itself authorise payment or fulfilment.",
      "为调整大小、完成提示定义小型类型化协议，不含个人资料或可执行HTML；完成消息本身不能批准扣款或履约。"
    ],
    [
      "In isolated authorised pages, exercise wrong origin, wrong frame, malformed payload and valid payload. Verify the fallback link if the embed cannot load.",
      "在隔离获准页面演练来源错误、窗口错误、结构错误及合法请求，另验收组件不可用时的独立入口。"
    ]
  ],
  "result": [
    "Only the first row satisfies the proposed resize contract. The200–1200 interval is a synthetic UI choice, not a browser standard or a security guarantee. Origin checks and sandboxing solve different parts of trust; neither removes the need for server-side authorisation.",
    "只有第一行符合拟定的高度协议。200–1200是合成界面选择，不是浏览器标准或安全保证。来源核对与沙箱处理不同信任问题，都不能代替服务端授权。"
  ],
  "accept": [
    "Require documented capabilities, exact origins, validated protocol and a functional fallback. A screenshot of the embedded page cannot establish those controls.",
    "验收须有能力清单、准确来源、验证后的协议及可用回退入口，嵌入页面截图不能证明这些控制。"
  ],
  "limit": [
    "Defensive synthetic contract; no external frame was messaged, embedded or given permissions. Browser/vendor compatibility and security approval are still required for a real integration.",
    "仅为合成防御合同；没有向外部框架发消息、嵌入内容或授予权限，真实集成仍需浏览器兼容及安全批准。"
  ]
}