LocalAI

mirror/LocalAI

0 Fork 0

mirror of https://github.com/mudler/LocalAI.git synced 2026-10-28 09:08:54 -04:00

Files

T

History

mudler-agentandEttore Di Giacinto 9ad78381d8 [ui] Serve canvas HTML previews with their own CSP (#12715 )

fix(ui): serve canvas HTML previews from a route with their own CSP

External scripts in canvas previews (for example three.js from unpkg)
were blocked. The preview used an iframe with srcdoc, which inherits the
global Content-Security-Policy, and a meta tag can only tighten it.

The UI now posts the HTML to POST /api/canvas/preview, gets a random id,
and loads GET /api/canvas/preview/:id in the iframe. That response sets
its own CSP that allows scripts from unpkg, jsdelivr, cdnjs, the
Tailwind CDN and jQuery. The global CSP is unchanged. The iframe keeps
sandbox="allow-scripts" without allow-same-origin.

Previews are kept in memory for 10 minutes and are never written to
disk. The GET route is public because the id is the capability and a
frame navigation cannot send API key headers.

Assisted-by: Claude:claude-haiku-5-5 [go test] [npm]

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-17 00:54:22 +02:00

application

fix(backends): flag a llama-cpp backend that predates native decisions (#12733 )

2026-10-16 10:41:45 +02:00

backend

fix(backends): flag a llama-cpp backend that predates native decisions (#12733 )

2026-10-16 10:41:45 +02:00

cli

feat(audio): add YuE2 music generation (#12617 )

2026-10-11 00:26:10 +02:00

clients

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087 )