Skip to content

Add inline HTML previews to Orbit#359

Merged
dannon merged 1 commit into
mainfrom
codex/html-preview-orbit
Jun 25, 2026
Merged

Add inline HTML previews to Orbit#359
dannon merged 1 commit into
mainfrom
codex/html-preview-orbit

Conversation

@jgoecks

@jgoecks jgoecks commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Adds inline HTML preview support to Orbit’s File tab. HTML files now render in a sandboxed iframe with local assets resolved through the cwd-jailed orbit-artifact:// protocol, remain preview-only in the editor, and can still be opened in a hardened external window with Escape-to-close support.

@dannon

dannon commented Jun 25, 2026

Copy link
Copy Markdown
Member

This is solid -- cwd jail holds up (realpath both sides + the startsWith check), and the opaque-origin sandbox + CSP is the right boundary. Skipping DOMPurify is correct here; sanitizing would just strip the scripts reports need.

One follow-up, not blocking (Claude flagged this on a review pass): the CSP <meta> is injected by regex-matching the first <head>, and a crafted file can dodge it -- a <head> in a comment or attribute before the real head lands the meta in an inert spot and the doc parses with no CSP. Bounded (opaque origin + CORS still block reading other cwd files), but it'd let a malicious report exfil its own content to the network. Real fix is a CSP response header via a protocol handler instead of blob: + injected meta. I'll open an issue.

Merging -- thanks!

@dannon dannon merged commit b33845b into main Jun 25, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants