Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
C
coopwire-hypothesis
Project
Project
Details
Activity
Releases
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
孙灵跃 Leon Sun
coopwire-hypothesis
Commits
9be0b64c
Commit
9be0b64c
authored
Jan 19, 2024
by
Alejandro Celaya
Committed by
Alejandro Celaya
Jan 22, 2024
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Protect the sidebar's iframe allow attribute
parent
9fa607e8
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
22 additions
and
7 deletions
+22
-7
sidebar.tsx
src/annotator/sidebar.tsx
+11
-6
sidebar-test.js
src/annotator/test/sidebar-test.js
+11
-1
No files found.
src/annotator/sidebar.tsx
View file @
9be0b64c
...
@@ -70,7 +70,7 @@ export type SidebarContainerConfig = {
...
@@ -70,7 +70,7 @@ export type SidebarContainerConfig = {
/**
/**
* Create the iframe that will load the sidebar application.
* Create the iframe that will load the sidebar application.
*/
*/
function
createSidebarIframe
(
config
:
SidebarConfig
):
HTMLIFrameElement
{
export
function
createSidebarIframe
(
config
:
SidebarConfig
):
HTMLIFrameElement
{
const
sidebarURL
=
config
.
sidebarAppUrl
;
const
sidebarURL
=
config
.
sidebarAppUrl
;
const
sidebarAppSrc
=
addConfigFragment
(
const
sidebarAppSrc
=
addConfigFragment
(
sidebarURL
,
sidebarURL
,
...
@@ -79,15 +79,20 @@ function createSidebarIframe(config: SidebarConfig): HTMLIFrameElement {
...
@@ -79,15 +79,20 @@ function createSidebarIframe(config: SidebarConfig): HTMLIFrameElement {
const
sidebarFrame
=
document
.
createElement
(
'iframe'
);
const
sidebarFrame
=
document
.
createElement
(
'iframe'
);
// Enable media in annotations to be shown fullscreen
sidebarFrame
.
setAttribute
(
'allowfullscreen'
,
''
);
sidebarFrame
.
src
=
sidebarAppSrc
;
sidebarFrame
.
src
=
sidebarAppSrc
;
sidebarFrame
.
title
=
'Hypothesis annotation viewer'
;
sidebarFrame
.
title
=
'Hypothesis annotation viewer'
;
sidebarFrame
.
className
=
'sidebar-frame'
;
sidebarFrame
.
className
=
'sidebar-frame'
;
sidebarFrame
.
allow
=
'clipboard-write'
;
return
sidebarFrame
;
// Enable media in annotations to be shown fullscreen, and allow copying to
// the clipboard.
sidebarFrame
.
allow
=
'fullscreen; clipboard-write'
;
// In viahtml, pywb uses wombat.js, which monkey-patches some JS methods.
// One of those causes the `allow` attribute to be overwritten, so we want to
// make it non-writable to preserve the permissions we set above.
return
Object
.
defineProperty
(
sidebarFrame
,
'allow'
,
{
writable
:
false
,
});
}
}
type
GestureState
=
{
type
GestureState
=
{
...
...
src/annotator/test/sidebar-test.js
View file @
9be0b64c
import
{
TinyEmitter
}
from
'tiny-emitter'
;
import
{
TinyEmitter
}
from
'tiny-emitter'
;
import
{
addConfigFragment
}
from
'../../shared/config-fragment'
;
import
{
addConfigFragment
}
from
'../../shared/config-fragment'
;
import
{
Sidebar
,
MIN_RESIZE
,
$imports
}
from
'../sidebar'
;
import
{
Sidebar
,
MIN_RESIZE
,
$imports
,
createSidebarIframe
}
from
'../sidebar'
;
import
{
Emitter
}
from
'../util/emitter'
;
import
{
Emitter
}
from
'../util/emitter'
;
const
DEFAULT_WIDTH
=
350
;
const
DEFAULT_WIDTH
=
350
;
...
@@ -1138,4 +1138,14 @@ describe('Sidebar', () => {
...
@@ -1138,4 +1138,14 @@ describe('Sidebar', () => {
assert
.
calledWith
(
guestRPC
().
call
,
'selectAnnotations'
,
tags
,
true
);
assert
.
calledWith
(
guestRPC
().
call
,
'selectAnnotations'
,
tags
,
true
);
});
});
});
});
describe
(
'createSidebarIframe'
,
()
=>
{
it
(
'does not let `allow` attribute to be overwritten'
,
()
=>
{
const
iframe
=
createSidebarIframe
({
sidebarAppUrl
:
'https://foo.com'
});
assert
.
throws
(()
=>
{
iframe
.
allow
=
'something else'
;
},
"Cannot assign to read only property 'allow' of object '#<HTMLIFrameElement>'"
);
});
});
});
});
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment