fix harden preview against self XSS

Signed-off-by: RonniSkansing <rskansing@gmail.com>

backend/controller/preview.go

@@ -0,0 +1,39 @@
+package controller
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Preview renders admin authored preview content isolated from the admin origin.
+type Preview struct {
+	Common
+}
+
+// previewMaxBodyBytes caps the posted content so an authenticated request can
+// not spill an unbounded body to disk during form parsing. A preview is a page
+// or email template plus inline data urls, well under this.
+const previewMaxBodyBytes = 20 << 20
+
+// Render returns the posted content as an html document carrying a sandbox
+// content security policy. The sandbox flag gives the document an opaque origin,
+// so scripts in the previewed content can not read the admin session, cookies or
+// call the API, while the document still gets its own policy and loads its own
+// external images, styles, fonts and scripts for an accurate preview. The
+// security headers middleware sets the strict admin policy on every response;
+// this handler then replaces that header with its own sandbox policy, so the
+// preview does not inherit it. allow-same-origin is deliberately absent.
+func (p *Preview) Render(g *gin.Context) {
+	_, _, ok := p.handleSession(g)
+	if !ok {
+		return
+	}
+	g.Request.Body = http.MaxBytesReader(g.Writer, g.Request.Body, previewMaxBodyBytes)
+	content := g.PostForm("content")
+	g.Header(
+		"Content-Security-Policy",
+		"sandbox allow-scripts allow-forms allow-popups allow-modals",
+	)
+	g.Data(http.StatusOK, "text/html; charset=utf-8", []byte(content))
+}