feat(vscode-extension): add sandbox attribute to iframe for allow png export downloads

Ivanruii · Ivanruii · commit 683b438b87a4 · 2026-04-20T12:31:05.000+02:00
diff --git a/packages/mcp/src/renderer/bridge.server.ts b/packages/mcp/src/renderer/bridge.server.ts
@@ -41,7 +41,7 @@ function buildBridgeHtml(): string {
   </style>
 </head>
 <body>
-  <iframe id="qm" src="${QUICKMOCK_URL}" allow="clipboard-read; clipboard-write"></iframe>
+  <iframe id="qm" src="${QUICKMOCK_URL}" sandbox="allow-scripts allow-same-origin" allow="clipboard-read; clipboard-write"></iframe>
   <script>
     window.__qmReady = false
     window.__renderComplete = false
diff --git a/packages/vscode-extension/src/webview/main.ts b/packages/vscode-extension/src/webview/main.ts
@@ -9,6 +9,10 @@ const appOrigin = new URL(appUrl).origin;
 
 const iframe = document.createElement('iframe');
 iframe.src = appUrl;
+iframe.setAttribute(
+  'sandbox',
+  'allow-scripts allow-same-origin allow-downloads'
+);
 iframe.allow = 'clipboard-read; clipboard-write';
 iframe.title = 'QuickMock Application';
 document.body.appendChild(iframe);
