sunpeak 0.20.53 → 0.20.56

package/dist/{inspector-BtYInER9.cjs → inspector-CoBJOqh4.cjs}

@@ -5693,6 +5693,15 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   var innerFrame = null;
   var innerWindow = null;
   var platformScript = ${escapedPlatformScript};
+  var DEFAULT_INNER_SANDBOX =
+    'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+  var ALLOWED_INNER_SANDBOX_TOKENS = {
+    'allow-scripts': true,
+    'allow-same-origin': true,
+    'allow-forms': true,
+    'allow-popups': true,
+    'allow-popups-to-escape-sandbox': true
+  };
 
   // Relay messages between parent (host) and inner iframe (app)
   window.addEventListener('message', function(event) {
@@ -5771,8 +5780,7 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     if (innerFrame) innerFrame.remove();
 
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox = params.sandbox ||
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = sanitizeInnerSandbox(params.sandbox);
     if (params.allow) innerFrame.allow = params.allow;
     document.body.appendChild(innerFrame);
     innerWindow = innerFrame.contentWindow;
@@ -5787,14 +5795,15 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   }
 
   function createInnerFrameWithSrc(params) {
+    var safeSrc = normalizeInnerSrc(params && params.src);
+    if (!safeSrc) return;
     clearInterval(readyInterval);
     if (innerFrame) innerFrame.remove();
 
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox =
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = DEFAULT_INNER_SANDBOX;
     if (params.allow) innerFrame.allow = params.allow;
-    innerFrame.src = params.src;
+    innerFrame.src = safeSrc;
     innerFrame.style.height = '100%';
 
     // Set color-scheme on the inner iframe to match the host theme.
@@ -5856,6 +5865,26 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     innerWindow = innerFrame.contentWindow;
   }
 
+  function sanitizeInnerSandbox(value) {
+    if (typeof value !== 'string' || !value.trim()) return DEFAULT_INNER_SANDBOX;
+    var tokens = value.trim().split(/\\s+/);
+    for (var i = 0; i < tokens.length; i++) {
+      if (!ALLOWED_INNER_SANDBOX_TOKENS[tokens[i]]) return DEFAULT_INNER_SANDBOX;
+    }
+    return tokens.join(' ');
+  }
+
+  function normalizeInnerSrc(value) {
+    if (typeof value !== 'string') return null;
+    try {
+      var url = new URL(value, window.location.href);
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+      return url.toString();
+    } catch(e) {
+      return null;
+    }
+  }
+
   // Paint fence responder — same as in iframe-resource.ts
   var PAINT_FENCE_SCRIPT = 'window.addEventListener("message",function(e){' +
     'if(e.data&&e.data.method==="sunpeak/fence"){' +
@@ -9787,4 +9816,4 @@ Object.defineProperty(exports, "useThemeContext", {
 	}
 });
 
-//# sourceMappingURL=inspector-BtYInER9.cjs.map
+//# sourceMappingURL=inspector-CoBJOqh4.cjs.map