CalvinBackup/anonymous_github
1
0
Fork 0
mirror of https://github.com/tdurieux/anonymous_github.git synced 2026-09-12 05:38:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #808 from tdurieux/fix/webview-script-playback

Browse Source 
fix: restore scripts and video playback on project pages
This commit is contained in:
Thomas Durieux
2026-09-09 10:23:45 +02:00
committed by GitHub
parent f27e9ca9a0 74bd6bb779
commit da247de018
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/routes/webview.ts
+3 -1
View File
@@ -65,7 +65,9 @@ async function webView(
req: express.Request<{ repoId: string; path?: string[] }>,
res: express.Response
) {
res.header("Content-Security-Policy", "sandbox allow-popups allow-forms allow-modals");
// Project pages need scripts and autoplay, but must stay isolated from the app.
// Keep allow-same-origin absent so repository documents retain an opaque origin.
res.header("Content-Security-Policy", "sandbox allow-scripts allow-popups allow-forms allow-modals");
const repo = await getRepo(req, res);
if (!repo) return;
try {
test/production-regressions.test.js
+2 -1
View File
@@ -247,7 +247,7 @@ describe("production regressions", function () {
expect(second.headers.ETag).not.to.equal(first.headers.ETag);
expect(second.statusCode).not.to.equal(304);
});
it("decodes webview filenames and sandboxes rendered documents", async function () {
it("decodes webview filenames and allows scripts without same-origin access", async function () {
const File = require("../src/core/AnonymizedFile").default;
const utils = require("../src/server/routes/route-utils");
const repo = { options: { terms: [], page: true, pageSource: { path: "/", branch: "main" }, image: true }, model: { source: { branch: "main" } } };
@@ -260,6 +260,7 @@ describe("production regressions", function () {
await handler({ path: "/repo/my%20file.html", params: { repoId: "repo" }, headers: {} }, res);
expect(path).to.equal("my file.html");
expect(res.headers["Content-Security-Policy"]).to.include("sandbox");
expect(res.headers["Content-Security-Policy"]).to.include("allow-scripts");
expect(res.headers["Content-Security-Policy"]).not.to.include("allow-same-origin");
});
it("terminates the streamer response after a late upstream error", async function () {