Do not inline script for code editor preview

Created on 19 February 2025, about 1 month ago

Overview

The code component preview (implemented in ✨ Preview for code components Active ) renders an <iframe> with dynamically generated inline JavaScript code that contains the compiled code for the code component, and a call to Preact's render() method.

This approach is problematic with Content Security Policy (CSP). Best-practice CSP configurations use script-src directives that explicitly forbid inline scripts via unsafe-inline restrictions.

Proposed resolution

After discussing several ideas with @effulgentsia and @mglaman:

  1. Remove the inline code, move it to a static file that can be included in a script tag via the src attribute.
  2. Add data needed to generate the preview in a <script type="application/json"></script> tag
πŸ“Œ Task
Status

Active

Version

0.0

Component

Page builder

Created by

πŸ‡³πŸ‡±Netherlands balintbrews Amsterdam, NL

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024