From ef3a75d58e59a96259fdc8fefa040a1e9618043a Mon Sep 17 00:00:00 2001
From: Elian Doran <contact@eliandoran.me>
Date: Mon, 17 Feb 2025 21:49:24 +0200
Subject: [PATCH] feat(webview): set up some sandboxing for <iframe>

---
 src/public/app/widgets/type_widgets/web_view.ts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/public/app/widgets/type_widgets/web_view.ts b/src/public/app/widgets/type_widgets/web_view.ts
index cc2fb1cae..3e57bce03 100644
--- a/src/public/app/widgets/type_widgets/web_view.ts
+++ b/src/public/app/widgets/type_widgets/web_view.ts
@@ -5,8 +5,6 @@ import type FNote from "../../entities/fnote.js";
 import type { EventData } from "../../components/app_context.js";
 import utils from "../../services/utils.js";
 
-const el = utils.isElectron() ? "webview" : "iframe";
-
 const TPL = `
 <div class="note-detail-web-view note-detail-printable" style="height: 100%">
     <div class="note-detail-web-view-help alert alert-warning" style="margin: 50px; padding: 20px 20px 0px 20px;">
@@ -21,9 +19,17 @@ const TPL = `
         <p>${t("web_view.experimental_note")}</p>
     </div>
 
-    <${el} class="note-detail-web-view-content"></${el}>
+    ${buildElement()}
 </div>`;
 
+function buildElement() {
+    if (!utils.isElectron()) {
+        return `<iframe class="note-detail-web-view-content" sandbox="allow-same-origin allow-scripts"></iframe>`;
+    } else {
+        return `<webview class="note-detail-web-view-content"></webview>`;
+    }
+}
+
 export default class WebViewTypeWidget extends TypeWidget {
 
     private $noteDetailWebViewHelp!: JQuery<HTMLElement>;