@optilogic/core 1.2.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +64 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +18 -1
- package/dist/index.d.ts +18 -1
- package/dist/index.js +64 -2
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
- package/src/components/file-view/components/HtmlRenderer.tsx +108 -2
package/dist/index.cjs
CHANGED
|
@@ -7487,18 +7487,80 @@ function CsvRenderer({ content, className }) {
|
|
|
7487
7487
|
) });
|
|
7488
7488
|
}
|
|
7489
7489
|
CsvRenderer.displayName = "CsvRenderer";
|
|
7490
|
+
var CSP_POLICY = [
|
|
7491
|
+
"default-src 'none'",
|
|
7492
|
+
"script-src 'unsafe-inline'",
|
|
7493
|
+
"style-src 'unsafe-inline'",
|
|
7494
|
+
"img-src data: blob:"
|
|
7495
|
+
].join("; ");
|
|
7496
|
+
var PERMISSIONS_POLICY = [
|
|
7497
|
+
"camera=()",
|
|
7498
|
+
"microphone=()",
|
|
7499
|
+
"geolocation=()",
|
|
7500
|
+
"payment=()",
|
|
7501
|
+
"usb=()",
|
|
7502
|
+
"display-capture=()",
|
|
7503
|
+
"fullscreen=()",
|
|
7504
|
+
"autoplay=()",
|
|
7505
|
+
"web-share=()",
|
|
7506
|
+
"screen-wake-lock=()",
|
|
7507
|
+
"xr-spatial-tracking=()",
|
|
7508
|
+
"magnetometer=()",
|
|
7509
|
+
"gyroscope=()",
|
|
7510
|
+
"accelerometer=()"
|
|
7511
|
+
].join(", ");
|
|
7512
|
+
function buildSandboxedHtml(content) {
|
|
7513
|
+
return `<!DOCTYPE html>
|
|
7514
|
+
<html>
|
|
7515
|
+
<head>
|
|
7516
|
+
<meta http-equiv="Content-Security-Policy" content="${CSP_POLICY}">
|
|
7517
|
+
<script>
|
|
7518
|
+
// Neutralise APIs that the sandbox + CSP can't fully block.
|
|
7519
|
+
// This runs in <head> before any user content in <body>.
|
|
7520
|
+
// Uses Object.defineProperty to make overrides non-configurable
|
|
7521
|
+
// so user scripts cannot restore the original via prototype tricks.
|
|
7522
|
+
(function(){
|
|
7523
|
+
// postMessage: iframe can message parent even without allow-same-origin.
|
|
7524
|
+
// Kill it so content can't probe or spam any future parent listeners.
|
|
7525
|
+
// Also kill parent/top refs as an extra layer.
|
|
7526
|
+
var noop = function(){};
|
|
7527
|
+
try { Object.defineProperty(window, 'postMessage', { value: noop, writable: false, configurable: false }); } catch(e) {}
|
|
7528
|
+
try { Object.defineProperty(window, 'parent', { value: window, writable: false, configurable: false }); } catch(e) {}
|
|
7529
|
+
try { Object.defineProperty(window, 'top', { value: window, writable: false, configurable: false }); } catch(e) {}
|
|
7530
|
+
try { Object.defineProperty(window, 'opener', { value: null, writable: false, configurable: false }); } catch(e) {}
|
|
7531
|
+
|
|
7532
|
+
// RTCPeerConnection: not governed by CSP; could contact a STUN server
|
|
7533
|
+
// over UDP to leak the user's IP. Kill all browser-prefixed variants.
|
|
7534
|
+
var rtcNames = ['RTCPeerConnection', 'webkitRTCPeerConnection', 'mozRTCPeerConnection'];
|
|
7535
|
+
for (var i = 0; i < rtcNames.length; i++) {
|
|
7536
|
+
try { Object.defineProperty(window, rtcNames[i], { value: undefined, writable: false, configurable: false }); } catch(e) {}
|
|
7537
|
+
}
|
|
7538
|
+
})();
|
|
7539
|
+
</script>
|
|
7540
|
+
</head>
|
|
7541
|
+
<body>${content}</body>
|
|
7542
|
+
</html>`;
|
|
7543
|
+
}
|
|
7490
7544
|
function HtmlRenderer({
|
|
7491
7545
|
content,
|
|
7492
7546
|
fileName,
|
|
7493
7547
|
className
|
|
7494
7548
|
}) {
|
|
7549
|
+
const srcDoc = React20__namespace.useMemo(
|
|
7550
|
+
() => buildSandboxedHtml(content ?? ""),
|
|
7551
|
+
[content]
|
|
7552
|
+
);
|
|
7553
|
+
const iframeProps = { csp: CSP_POLICY };
|
|
7495
7554
|
return /* @__PURE__ */ jsxRuntime.jsx(
|
|
7496
7555
|
"iframe",
|
|
7497
7556
|
{
|
|
7498
|
-
srcDoc
|
|
7557
|
+
srcDoc,
|
|
7499
7558
|
sandbox: "allow-scripts",
|
|
7500
7559
|
title: fileName,
|
|
7501
|
-
|
|
7560
|
+
referrerPolicy: "no-referrer",
|
|
7561
|
+
allow: PERMISSIONS_POLICY,
|
|
7562
|
+
className: cn("h-full w-full border-0", className),
|
|
7563
|
+
...iframeProps
|
|
7502
7564
|
}
|
|
7503
7565
|
);
|
|
7504
7566
|
}
|