mudler-agentandEttore Di Giacinto 9ad78381d8 [ui] Serve canvas HTML previews with their own CSP (#12715) ...

fix(ui): serve canvas HTML previews from a route with their own CSP

External scripts in canvas previews (for example three.js from unpkg)
were blocked. The preview used an iframe with srcdoc, which inherits the
global Content-Security-Policy, and a meta tag can only tighten it.

The UI now posts the HTML to POST /api/canvas/preview, gets a random id,
and loads GET /api/canvas/preview/:id in the iframe. That response sets
its own CSP that allows scripts from unpkg, jsdelivr, cdnjs, the
Tailwind CDN and jQuery. The global CSP is unchanged. The iframe keeps
sandbox="allow-scripts" without allow-same-origin.

Previews are kept in memory for 10 minutes and are never written to
disk. The GET route is public because the id is the capability and a
frame navigation cannot send API key headers.

Assisted-by: Claude:claude-haiku-5-5 [go test] [npm]

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-17 00:54:22 +02:00

..

anthropic

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

elevenlabs

feat(audio): add YuE2 music generation (#12617)

2026-10-11 00:26:10 +02:00

explorer

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

jina

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

localai

[ui] Serve canvas HTML previews with their own CSP (#12715)

2026-10-17 00:54:22 +02:00

mcp

fix(mcp): check token expiry after failed refresh

2026-10-13 08:08:26 +00:00

ollama

fix(ollama): report on-disk size for /api/tags and /api/ps (#11989)

2026-09-28 00:11:41 +02:00

openai

fix(realtime): end a client response cleanly when its commit fails

2026-10-13 08:44:23 +00:00

openresponses

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00