You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds inline HTML preview support to Orbit’s File tab. HTML files now render in a sandboxed iframe with local assets resolved through the cwd-jailed orbit-artifact:// protocol, remain preview-only in the editor, and can still be opened in a hardened external window with Escape-to-close support.
This is solid -- cwd jail holds up (realpath both sides + the startsWith check), and the opaque-origin sandbox + CSP is the right boundary. Skipping DOMPurify is correct here; sanitizing would just strip the scripts reports need.
One follow-up, not blocking (Claude flagged this on a review pass): the CSP <meta> is injected by regex-matching the first <head>, and a crafted file can dodge it -- a <head> in a comment or attribute before the real head lands the meta in an inert spot and the doc parses with no CSP. Bounded (opaque origin + CORS still block reading other cwd files), but it'd let a malicious report exfil its own content to the network. Real fix is a CSP response header via a protocol handler instead of blob: + injected meta. I'll open an issue.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds inline HTML preview support to Orbit’s File tab. HTML files now render in a sandboxed iframe with local assets resolved through the cwd-jailed orbit-artifact:// protocol, remain preview-only in the editor, and can still be opened in a hardened external window with Escape-to-close support.