@opengeni/react 0.48.0 → 0.57.0

package/src/components/artifacts/published-html-artifact-frame.tsx

@@ -0,0 +1,38 @@
+import type { CSSProperties } from "react";
+
+export const PUBLISHED_HTML_ARTIFACT_IFRAME_SANDBOX = [
+  "allow-downloads",
+  "allow-forms",
+  "allow-modals",
+  "allow-orientation-lock",
+  "allow-pointer-lock",
+  "allow-popups",
+  "allow-popups-to-escape-sandbox",
+  "allow-presentation",
+  "allow-scripts",
+].join(" ");
+
+export type PublishedHtmlArtifactFrameProps = {
+  html: string;
+  title: string;
+  className?: string;
+  style?: CSSProperties;
+};
+
+/**
+ * Render exact published HTML in an opaque-origin iframe. Artifact scripts,
+ * external resources, forms, popups, and downloads work without granting
+ * parent-origin authority, shared cookies/storage, or top-level navigation.
+ */
+export function PublishedHtmlArtifactFrame(props: PublishedHtmlArtifactFrameProps) {
+  return (
+    <iframe
+      title={props.title}
+      sandbox={PUBLISHED_HTML_ARTIFACT_IFRAME_SANDBOX}
+      referrerPolicy="no-referrer"
+      srcDoc={props.html}
+      className={props.className}
+      style={props.style}
+    />
+  );
+}