Menghuan1918
302c20109f
- html viewer：.html/.htm 沙箱 iframe 预览（相对资源经 /sidebar/html 路径编码路由加载，CSP sandbox + 信任围栏 + cwd 边界），预览/编辑切换 - browser tab：+ 菜单多开（browser:<n>），地址栏后退/前进/刷新/在浏览器中打开（15px 图标），URL 与标题按会话持久化（patchTab + nextBrowser） - 安全：iframe 一律不透明源沙箱（无 allow-same-origin/top-navigation、no-referrer、权限策略全禁、禁 srcdoc）；地址栏仅 http(s)、拒绝 localhost 等本机地址；界面实时沙箱状态（关闭红色警示）+ 临时解锁/恢复 - 设置：htmlViewerNoSandbox / htmlViewerDefaultUnsafe / browserNoSandbox / browserInterceptLinks 四个声明式二级设置（默认安全） - 外链拦截：聊天/界面 http(s) 外链默认在侧边栏打开（openTab seed.url），Ctrl/Cmd 点击放行 - 嵌入拒绝面板：browser.probe 路由探测 X-Frame-Options/frame-ancestors，被拒站点显示原因 + 在浏览器中打开/仍然加载 - 设置页可滚动；内置 7 tab + 9 viewer；新增设计文档；268 个测试全绿
27 lines
1.1 KiB
TypeScript
27 lines
1.1 KiB
TypeScript
/**
|
|
* Pure helpers for the `browser.probe` route (sidebar browser): the host
|
|
* fetches the response HEADERS of a URL the user is browsing and the client
|
|
* decides whether the target site forbids being embedded (X-Frame-Options /
|
|
* CSP frame-ancestors are exactly the signals the browser enforces when it
|
|
* refuses an iframe load). Kept dependency-free so the parser is
|
|
* unit-testable.
|
|
*/
|
|
|
|
/**
|
|
* Extract the `frame-ancestors` source list of a Content-Security-Policy
|
|
* header, or undefined when the directive is absent (or empty). The
|
|
* directive is the only one with a source list; sources are space-separated
|
|
* tokens (`'none'`, `'self'`, `*`, or origins).
|
|
*/
|
|
export function extractFrameAncestors(csp: string | null): string[] | undefined {
|
|
if (csp === null) return undefined
|
|
for (const directive of csp.split(';')) {
|
|
const parts = directive.trim().split(/\s+/)
|
|
if (parts[0] === 'frame-ancestors') {
|
|
const sources = parts.slice(1).filter(source => source !== '')
|
|
return sources.length === 0 ? undefined : sources
|
|
}
|
|
}
|
|
return undefined
|
|
}
|