From 756841f8c22f53b59c29404e9b65dda31136d49d Mon Sep 17 00:00:00 2001 From: Michael Czechowski Date: Sat, 28 Mar 2026 16:38:56 +0100 Subject: [PATCH] fix(security): sandbox preview iframes to prevent XSS Add sandbox='allow-scripts' to all preview iframes. This isolates user-executed code from the parent page's localStorage (auth tokens), cookies, and DOM. Switch from document.write() to srcdoc attribute since sandboxed iframes can't use document.write(). Addresses SEC-1 (critical) from security audit. --- src/impl/LessonEngine.js | 44 ++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/src/impl/LessonEngine.js b/src/impl/LessonEngine.js index 3604e16..e836b2d 100644 --- a/src/impl/LessonEngine.js +++ b/src/impl/LessonEngine.js @@ -216,18 +216,18 @@ export class LessonEngine { iframe.style.height = "100%"; iframe.style.border = "none"; iframe.title = "Preview"; + iframe.setAttribute("sandbox", "allow-scripts"); const container = document.getElementById(previewContainer || "preview-area"); container.innerHTML = ""; container.appendChild(iframe); - const iframeDoc = iframe.contentDocument || iframe.contentWindow.document; - iframeDoc.open(); + let html; if (mode === "html" || mode === "playground") { // For HTML/playground mode, user code IS the HTML content (may include