shadowdaoandClaude Opus 5.5
6d6994f009
Preview and history Preview opened the composed page (raw site head code included) as a panel-origin blob: tab, so a customer's <script> ran with the viewer's panel session and CSRF token (root included). Both now open an empty shell tab inside the click and render the page in an <iframe srcdoc> with sandbox="allow-scripts allow-popups allow-forms" (no allow-same-origin): an opaque origin, no opener. Tests assert the sandbox attribute and scan the source for any remaining text/html blob / document.write / blob tab path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
