Opening links from a sandboxed iframe in system browser

["Ionuț G. Stan"]

Hi,I'm using a sandboxed iframe (<iframe sandbox>) to display untrusted
HTML content and I'd like the user to be able to click on links and have
them being opened in the default system browser, as opposed to
navigating to that page inside the iframe (or not at all because of
security restrictions).

Because the iframe is sandboxed I can't attach event listeners (which
would open the browser using gui.Shell) to link clicks, even when the
listeners are added from the parent window. This is a limitation of the
sandbox model IMO. The JS engine should be able to figure out if the
event listeners for the iframe elements were added from the outside and
let them execute.

Anyway, this might be pretty hard to achieve, so I was wondering whether
you guys see a solution to this problem, or whether it would be hard to
add support for a target="nw-external" attribute (just an example value)
in node-webkit that would open those links in the system web browser?

Any other ideas are welcome as well.

Here's a sample HTML file demonstrating what I'd like to achieve:
https://gist.github.com/igstan/5ad852d452acfe9327b4

P.S. Thanks for your work on this project!

--
Ionuț G. Stan | http://igstan.ro