fix: improve pdf rendering and html

src/server/routes/file.ts

@@ -18,6 +18,27 @@ function decodePathSegment(segment: string): string {
   }
 }
 
+// Extensions the browser will execute script from when it renders the
+// response as a document (directly, or via the "Raw" action).
+const SCRIPTABLE_EXTENSIONS = new Set([
+  "html",
+  "htm",
+  "xhtml",
+  "xht",
+  "svg",
+  "xml",
+  "xsl",
+  "xslt",
+  "mhtml",
+]);
+
+export function isScriptableDocument(anonymizedPath: string): boolean {
+  const name = anonymizedPath.substring(anonymizedPath.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  if (dot < 0) return false;
+  return SCRIPTABLE_EXTENSIONS.has(name.substring(dot + 1).toLowerCase());
+}
+
 export function filePathFromRequestUrl(
   reqUrl: string,
   protocol: string,
@@ -94,6 +115,20 @@ router.get(
         res.attachment(
           anonymizedPath.substring(anonymizedPath.lastIndexOf("/") + 1)
         );
+      } else if (isScriptableDocument(anonymizedPath)) {
+        // A repository's own .html/.svg is untrusted content served from our
+        // origin: opening it renders it as a document, and any script in it
+        // would run as the site itself (session cookie, same-origin fetches
+        // against /api). The CSP sandbox directive forces the response into an
+        // opaque origin, so the document still renders but can reach nothing
+        // of ours. Scripts are left out entirely, matching the file viewer's
+        // default (html-doc.js) — a reader who wants them opts in there.
+        // allow-same-origin must never be added: combined with allow-scripts
+        // it lets the document remove its own sandbox.
+        res.header(
+          "Content-Security-Policy",
+          "sandbox allow-popups allow-forms allow-modals"
+        );
       }
       const etag = fileETag(
         req.query.v as string | undefined,