@optilogic/core 1.2.0 → 1.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +66 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +18 -1
- package/dist/index.d.ts +18 -1
- package/dist/index.js +66 -2
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
- package/src/components/file-view/components/HtmlRenderer.tsx +110 -2
package/dist/index.cjs
CHANGED
|
@@ -7487,18 +7487,82 @@ function CsvRenderer({ content, className }) {
|
|
|
7487
7487
|
) });
|
|
7488
7488
|
}
|
|
7489
7489
|
CsvRenderer.displayName = "CsvRenderer";
|
|
7490
|
+
var CSP_POLICY = [
|
|
7491
|
+
"default-src 'none'",
|
|
7492
|
+
"script-src 'unsafe-inline'",
|
|
7493
|
+
"style-src 'unsafe-inline'",
|
|
7494
|
+
"img-src data: blob:"
|
|
7495
|
+
].join("; ");
|
|
7496
|
+
var PERMISSIONS_POLICY = [
|
|
7497
|
+
"camera=()",
|
|
7498
|
+
"microphone=()",
|
|
7499
|
+
"geolocation=()",
|
|
7500
|
+
"payment=()",
|
|
7501
|
+
"usb=()",
|
|
7502
|
+
"clipboard-read=()",
|
|
7503
|
+
"clipboard-write=()",
|
|
7504
|
+
"display-capture=()",
|
|
7505
|
+
"fullscreen=()",
|
|
7506
|
+
"autoplay=()",
|
|
7507
|
+
"web-share=()",
|
|
7508
|
+
"screen-wake-lock=()",
|
|
7509
|
+
"xr-spatial-tracking=()",
|
|
7510
|
+
"magnetometer=()",
|
|
7511
|
+
"gyroscope=()",
|
|
7512
|
+
"accelerometer=()"
|
|
7513
|
+
].join(", ");
|
|
7514
|
+
function buildSandboxedHtml(content) {
|
|
7515
|
+
return `<!DOCTYPE html>
|
|
7516
|
+
<html>
|
|
7517
|
+
<head>
|
|
7518
|
+
<meta http-equiv="Content-Security-Policy" content="${CSP_POLICY}">
|
|
7519
|
+
<script>
|
|
7520
|
+
// Neutralise APIs that the sandbox + CSP can't fully block.
|
|
7521
|
+
// This runs in <head> before any user content in <body>.
|
|
7522
|
+
// Uses Object.defineProperty to make overrides non-configurable
|
|
7523
|
+
// so user scripts cannot restore the original via prototype tricks.
|
|
7524
|
+
(function(){
|
|
7525
|
+
// postMessage: iframe can message parent even without allow-same-origin.
|
|
7526
|
+
// Kill it so content can't probe or spam any future parent listeners.
|
|
7527
|
+
// Also kill parent/top refs as an extra layer.
|
|
7528
|
+
var noop = function(){};
|
|
7529
|
+
try { Object.defineProperty(window, 'postMessage', { value: noop, writable: false, configurable: false }); } catch(e) {}
|
|
7530
|
+
try { Object.defineProperty(window, 'parent', { value: window, writable: false, configurable: false }); } catch(e) {}
|
|
7531
|
+
try { Object.defineProperty(window, 'top', { value: window, writable: false, configurable: false }); } catch(e) {}
|
|
7532
|
+
try { Object.defineProperty(window, 'opener', { value: null, writable: false, configurable: false }); } catch(e) {}
|
|
7533
|
+
|
|
7534
|
+
// RTCPeerConnection: not governed by CSP; could contact a STUN server
|
|
7535
|
+
// over UDP to leak the user's IP. Kill all browser-prefixed variants.
|
|
7536
|
+
var rtcNames = ['RTCPeerConnection', 'webkitRTCPeerConnection', 'mozRTCPeerConnection'];
|
|
7537
|
+
for (var i = 0; i < rtcNames.length; i++) {
|
|
7538
|
+
try { Object.defineProperty(window, rtcNames[i], { value: undefined, writable: false, configurable: false }); } catch(e) {}
|
|
7539
|
+
}
|
|
7540
|
+
})();
|
|
7541
|
+
</script>
|
|
7542
|
+
</head>
|
|
7543
|
+
<body>${content}</body>
|
|
7544
|
+
</html>`;
|
|
7545
|
+
}
|
|
7490
7546
|
function HtmlRenderer({
|
|
7491
7547
|
content,
|
|
7492
7548
|
fileName,
|
|
7493
7549
|
className
|
|
7494
7550
|
}) {
|
|
7551
|
+
const srcDoc = React20__namespace.useMemo(
|
|
7552
|
+
() => buildSandboxedHtml(content ?? ""),
|
|
7553
|
+
[content]
|
|
7554
|
+
);
|
|
7555
|
+
const iframeProps = { csp: CSP_POLICY };
|
|
7495
7556
|
return /* @__PURE__ */ jsxRuntime.jsx(
|
|
7496
7557
|
"iframe",
|
|
7497
7558
|
{
|
|
7498
|
-
srcDoc
|
|
7559
|
+
srcDoc,
|
|
7499
7560
|
sandbox: "allow-scripts",
|
|
7500
7561
|
title: fileName,
|
|
7501
|
-
|
|
7562
|
+
referrerPolicy: "no-referrer",
|
|
7563
|
+
allow: PERMISSIONS_POLICY,
|
|
7564
|
+
className: cn("h-full w-full border-0", className),
|
|
7565
|
+
...iframeProps
|
|
7502
7566
|
}
|
|
7503
7567
|
);
|
|
7504
7568
|
}
|