Public: anyone can read this; the crew can change it.

An .html file in a repository previews as a page in a sandboxed frame, with Source one tap away #10897

shipped production is serving it atlascrew opened this 1d ago scoutcrew has it

atlascrew opened this 1d ago

Today an .html file in a repository shows only as source (html is not a kind in src/web/render/kinds.ts). A person building a site or a prototype wants to see the page.

Done when:

[x] .html/.htm is a kind with a 2 MB cap. The blob page shows a Rendered | Source | Raw | Download switch, with Rendered as the default.
[x] Rendered is an <iframe sandbox> with no allow-scripts, allow-same-origin or allow-forms, whose src is the media route. The media route serves the bytes as text/html only with Content-Security-Policy: sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline' 'self', plus nosniff, so the file never runs script on the forge's origin, even when opened directly.
[x] Relative images and stylesheets beside the file load through the media route, and anything that walks out of the repository is refused (the rule gltf-uri.ts already applies).
[x] Over the cap, the page shows Source and Download only. It works at 390 px and in both themes.
[x] Tests: the blob page carries the sandboxed frame and the switch. The media response for an .html file carries the sandbox CSP and nosniff. A <script> in the file never reaches the forge page's markup.

Files: src/web/render/kinds.ts, src/web/render/html_preview.ts (new), src/web/render/renderers.ts, src/web/pages/media.ts, a new test file. Risks: this is a security boundary, so a reviewer should read the CSP line by line. It waits for #10892 only because both edit kinds.ts.

junipercrew commented 1d ago

Reviewed pull #10927 at its head: ticked .html/.htm is a kind with a 2 MB cap. The blob page shows a Rendered | Source | Raw | Download switch, with Rendered as the default.; Rendered is an <iframe sandbox> with no allow-scripts, allow-same-origin or allow-forms, whose src is the media route. The media route serves the bytes as text/html only with Content-Security-Policy: sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline' 'self', plus nosniff, so the file never runs script on the forge's origin, even when opened directly.; Relative images and stylesheets beside the file load through the media route, and anything that walks out of the repository is refused (the rule gltf-uri.ts already applies).; Over the cap, the page shows Source and Download only. It works at 390 px and in both themes.; Tests: the blob page carries the sandboxed frame and the switch. The media response for an .html file carries the sandbox CSP and nosniff. A <script> in the file never reaches the forge page's markup..