sunpeak 0.20.51 → 0.20.56

package/dist/{inspector-DQyl36w3.js → inspector-BYuRWH6c.js}

@@ -4571,7 +4571,7 @@ registerHostShell({
 }`
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+ext-apps@1.7.3_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__react-_eeb2b05587eabe4742497eb1f1b87bd3/node_modules/@modelcontextprotocol/ext-apps/dist/src/app-bridge.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+ext-apps@1.7.4_@modelcontextprotocol+sdk@1.29.0_zod@4.4.3__react-_bc4d5adeaec14d46b9a46bfff8177b13/node_modules/@modelcontextprotocol/ext-apps/dist/src/app-bridge.js
 ((X) => typeof __require < "u" ? __require : typeof Proxy < "u" ? new Proxy(X, { get: (Y, Z) => (typeof __require < "u" ? __require : Y)[Z] }) : X)(function(X) {
 	if (typeof __require < "u") return __require.apply(this, arguments);
 	throw Error("Dynamic require of \"" + X + "\" is not supported");
@@ -5692,6 +5692,15 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   var innerFrame = null;
   var innerWindow = null;
   var platformScript = ${escapedPlatformScript};
+  var DEFAULT_INNER_SANDBOX =
+    'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+  var ALLOWED_INNER_SANDBOX_TOKENS = {
+    'allow-scripts': true,
+    'allow-same-origin': true,
+    'allow-forms': true,
+    'allow-popups': true,
+    'allow-popups-to-escape-sandbox': true
+  };
 
   // Relay messages between parent (host) and inner iframe (app)
   window.addEventListener('message', function(event) {
@@ -5770,8 +5779,7 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     if (innerFrame) innerFrame.remove();
 
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox = params.sandbox ||
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = sanitizeInnerSandbox(params.sandbox);
     if (params.allow) innerFrame.allow = params.allow;
     document.body.appendChild(innerFrame);
     innerWindow = innerFrame.contentWindow;
@@ -5786,14 +5794,15 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   }
 
   function createInnerFrameWithSrc(params) {
+    var safeSrc = normalizeInnerSrc(params && params.src);
+    if (!safeSrc) return;
     clearInterval(readyInterval);
     if (innerFrame) innerFrame.remove();
 
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox =
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = DEFAULT_INNER_SANDBOX;
     if (params.allow) innerFrame.allow = params.allow;
-    innerFrame.src = params.src;
+    innerFrame.src = safeSrc;
     innerFrame.style.height = '100%';
 
     // Set color-scheme on the inner iframe to match the host theme.
@@ -5855,6 +5864,26 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     innerWindow = innerFrame.contentWindow;
   }
 
+  function sanitizeInnerSandbox(value) {
+    if (typeof value !== 'string' || !value.trim()) return DEFAULT_INNER_SANDBOX;
+    var tokens = value.trim().split(/\\s+/);
+    for (var i = 0; i < tokens.length; i++) {
+      if (!ALLOWED_INNER_SANDBOX_TOKENS[tokens[i]]) return DEFAULT_INNER_SANDBOX;
+    }
+    return tokens.join(' ');
+  }
+
+  function normalizeInnerSrc(value) {
+    if (typeof value !== 'string') return null;
+    try {
+      var url = new URL(value, window.location.href);
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+      return url.toString();
+    } catch(e) {
+      return null;
+    }
+  }
+
   // Paint fence responder — same as in iframe-resource.ts
   var PAINT_FENCE_SCRIPT = 'window.addEventListener("message",function(e){' +
     'if(e.data&&e.data.method==="sunpeak/fence"){' +
@@ -9613,4 +9642,4 @@ function Inspector({ children, app, simulations: initialSimulationsProp = EMPTY_
 //#endregion
 export { McpAppHost as C, registerHostShell as D, getRegisteredHosts as E, cn as O, extractResourceCSP as S, getHostShell as T, DEVICE_PRESETS as _, SidebarCollapsibleControl as a, isDevicePresetSelection as b, SidebarSelect as c, SimpleSidebar as d, ThemeProvider as f, CUSTOM_DEVICE_PRESET as g, useInspectorState as h, SidebarCheckbox as i, DEFAULT_STYLE_VARIABLES as k, SidebarTextarea as l, useMcpConnection as m, flattenAppToSimulations as n, SidebarControl as o, useThemeContext as p, resolveServerToolResult as r, SidebarInput as s, Inspector as t, SidebarToggle as u, DEVICE_PRESET_BY_ID as v, SCREEN_WIDTHS as w, IframeResource as x, getDevicePreset as y };
 
-//# sourceMappingURL=inspector-DQyl36w3.js.map
+//# sourceMappingURL=inspector-BYuRWH6c.js.map