mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-19 00:03:21 +00:00
3bba1c2270
Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy <meta> tag into all srcdoc iframes rendering untrusted content: - Artifacts (LLM-generated HTML previews) - FullHeightIframe (tool/embed output) - FilePreview (user-uploaded HTML files) - CitationModal (RAG document HTML) Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe attribute escaping. URL-based iframes (src=) are correctly excluded. Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy time, requires restart. Empty string (default) means no CSP restriction. |
||
|---|---|---|
| .. | ||
| BulkActionBar.svelte | ||
| CellEditor.svelte | ||
| FileCodeEditor.svelte | ||
| FileEntryRow.svelte | ||
| FileNavToolbar.svelte | ||
| FilePreview.svelte | ||
| JsonTreeView.svelte | ||
| NotebookView.svelte | ||
| PortList.svelte | ||
| PortPreview.svelte | ||
| SqliteView.svelte | ||