17 lines
878 B
TypeScript
17 lines
878 B
TypeScript
// Bundled by scripts/e2e-capture-security.mjs and run in real Firefox + Chromium.
|
|
import { captureHtml } from '../src/utils/self-review-capture';
|
|
import { CAPTURE_CSP } from '../src/utils/sanitize-capture-html';
|
|
|
|
(window as any).captureHtml = captureHtml;
|
|
/** Defence-in-depth probe: the capture frame WITHOUT the sanitiser (sandbox + CSP only). */
|
|
(window as any).rawFrame = (html: string) => new Promise<void>((resolve) => {
|
|
const f = document.createElement('iframe');
|
|
f.setAttribute('sandbox', 'allow-same-origin');
|
|
const CSP = CAPTURE_CSP;
|
|
f.setAttribute('csp', CSP);
|
|
f.style.cssText = 'position:fixed;left:-9999px;width:800px;height:600px';
|
|
f.addEventListener('load', () => setTimeout(resolve, 800), { once: true });
|
|
f.srcdoc = html.replace('<head>', `<head><meta http-equiv="Content-Security-Policy" content="${CSP}">`);
|
|
document.body.appendChild(f);
|
|
});
|