a113f25a62e21be3649442866623e296e041ca1a
captureFileViolations() pins the one allow-same-origin srcdoc frame: sandbox set once to exactly allow-same-origin, no script/form/popup/navigation tokens, srcdoc only from inlineResources(clean.html), sanitizeCaptureHtml called and its verdict checked before srcdoc. Eight mutated copies of the real source prove each rule fails. Plus a behavioural jsdom test of the real captureHtml frame. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Languages
TypeScript
76%
JavaScript
12.2%
HTML
8.6%
CSS
2.6%
PHP
0.4%
Other
0.2%