// 可独立测试的 HTML 预览安全策略。脚本和 HTTPS 外部资源可运行，满足图表、
// 地图、WebGL 等通用产物；iframe 保持 opaque origin，不能触达 zcbot 宿主权限。
export const HTML_PREVIEW_CSP = "default-src 'none'; " +
"script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https:; " +
"style-src 'unsafe-inline' https:; img-src data: blob: https:; " +
"media-src data: blob: https:; font-src data: https:; connect-src https:; " +
"worker-src blob:; child-src blob: https:; frame-src https:; manifest-src https:; " +
"object-src 'none'; form-action 'none'; base-uri 'none'";
export const HTML_PREVIEW_SANDBOX = "allow-scripts";
export function htmlPreviewDocument(text) {
const meta = ``;
const source = String(text || "");
if (/]*)?>/i.test(source)) {
return source.replace(/]*)?>/i, (head) => head + meta);
}
return `${meta}${source}`;
}
export function configureHtmlPreviewFrame(frame, text, title = "HTML 文件预览") {
frame.title = title;
frame.setAttribute("sandbox", HTML_PREVIEW_SANDBOX);
frame.setAttribute("csp", HTML_PREVIEW_CSP);
frame.referrerPolicy = "no-referrer";
frame.srcdoc = htmlPreviewDocument(text);
return frame;
}