Timothy Jaeryang Baek 3bba1c2270 feat: add IFRAME_CSP env var for srcdoc iframe content security policy ... Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy <meta> tag into all srcdoc iframes rendering untrusted content: - Artifacts (LLM-generated HTML previews) - FullHeightIframe (tool/embed output) - FilePreview (user-uploaded HTML files) - CitationModal (RAG document HTML) Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe attribute escaping. URL-based iframes (src=) are correctly excluded. Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy time, requires restart. Empty string (default) means no CSP restriction.		2026-05-11 01:56:02 +09:00
..
index.ts	feat: add IFRAME_CSP env var for srcdoc iframe content security policy	2026-05-11 01:56:02 +09:00