feat: remove allow-same-origin for better security.#69
Merged
Conversation
Owner
knightedcodemonkey
commented
Apr 11, 2026
knightedcodemonkey
commented
- closes Remove preview iframe allow-same-origin with diagnostics and auto-render performance parity #67
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens preview iframe isolation by removing allow-same-origin and migrating the preview runtime bootstrapping from parent-driven contentDocument mutation to a srcdoc + postMessage protocol, while also adding telemetry hooks and caching to preserve diagnostics/performance.
Changes:
- Replace same-origin iframe execution with a
srcdocbootstrap shell and a parent/iframe messaging protocol + reusable “bridge”. - Switch workspace virtual modules from Blob URLs + import-map wiring to cached
data:module URLs with import specifier rewriting. - Add preview telemetry events and an E2E assertion that the iframe sandbox blocks parent storage access.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/modules/render-runtime.js | Uses the new iframe bridge, adds preview telemetry, and adjusts auto-render debounce behavior. |
| src/modules/preview-runtime/virtual-workspace-modules.js | Introduces caching + rewrites imports to produce data: module URLs instead of Blob URLs/import-map entries. |
| src/modules/preview-runtime/iframe-preview-protocol.js | Adds a versioned message envelope and helpers for validating preview protocol messages. |
| src/modules/preview-runtime/iframe-preview-executor.js | Replaces parent contentDocument bootstrapping with srcdoc shell, removes allow-same-origin, and implements the bridge + protocol handling. |
| src/modules/preview-background.js | Removes direct iframe DOM access and forwards background-color changes via callback. |
| src/app.js | Wires preview background color changes into the render runtime bridge update method. |
| playwright/rendering-modes.spec.ts | Adds E2E test verifying sandbox isolation and inability to read parent localStorage. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
knightedcodemonkey
added a commit
that referenced
this pull request
May 2, 2026
* feat: idb infrastructure. (#63) * feat: dynamic tabs. (#64) * refactor: better accessbility for tabs. (#68) * feat: remove allow-same-origin for better security. (#69) * feat: tab reordering via drag-n-drop. (#70) * feat: explicit css imports, diagnostics per editor buffer. (#71) * feat: idb + github sync with atomic open and push to remote. (#78) * closes #73, closes #74, closes #75. * refactor: more colocation and smaller file sizes. (#79) * refactor: improvements with styles and gh syncs. (#82) * test: webkit flake. (#83) * test: address flake. (#84) * refactor: github pr context. (#85) * fix: require app in entry, hide workspaces without pat, remove star important. (#86) * feat: make idb source of truth for pr context. (#87) * fix: active pr context on reload and dedupe workspace identity. (#88) * fix: edited and push sync across reloads. (#89) * fix: properly commit tab name changes. (#90) * fix(tabs): filename edits, min-widths, scrolling, content sync. (#91) * feat: improved workspace disconnect and closed ux. (#92) * refactor: status styling and biome config. (#94) * fix(diagnostics): enforce current-editor snapshots and stale results. (#95) * fix: consistent head handling. (#96) * fix: prevent workspace overwrites. (#100) * fix(playwright): stabilize lint diagnostics waits with one-time rerun fallback. (#101) * feat: improved workspace ux and state identity separation. (#103) * fix: iframe protocol mismatch in receiver reads. (#104) * refactor: remove remaining fixed editor assumptions. (#105) * refactor: simplify PR close flow with deterministic workspace state updates (#106) * feat: mode-aware entry tab extensions. (#108) * feat: workspace status bar. (#109) * feat: tab-scoped ai chat. (#111) * refactor: better workspace drawer ux. (#112) * refactor: remove collapsible editors and update breakpoint styles. (#113) * docs: update for vnext. (#114) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.