mudler-agentandEttore Di Giacinto 9ad78381d8 [ui] Serve canvas HTML previews with their own CSP (#12715) ...

fix(ui): serve canvas HTML previews from a route with their own CSP

External scripts in canvas previews (for example three.js from unpkg)
were blocked. The preview used an iframe with srcdoc, which inherits the
global Content-Security-Policy, and a meta tag can only tighten it.

The UI now posts the HTML to POST /api/canvas/preview, gets a random id,
and loads GET /api/canvas/preview/:id in the iframe. That response sets
its own CSP that allows scripts from unpkg, jsdelivr, cdnjs, the
Tailwind CDN and jQuery. The global CSP is unchanged. The iframe keeps
sandbox="allow-scripts" without allow-same-origin.

Previews are kept in memory for 10 minutes and are never written to
disk. The GET route is public because the id is the capability and a
frame navigation cannot send API key headers.

Assisted-by: Claude:claude-haiku-5-5 [go test] [npm]

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-17 00:54:22 +02:00

..

apikeys_test.go

feat(auth): let users pause and resume their API keys (#12521)

2026-10-06 18:25:21 +02:00

apikeys.go

feat(auth): let users pause and resume their API keys (#12521)

2026-10-06 18:25:21 +02:00

auth_suite_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

branding_routes_test.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

csrf_test.go

fix(auth): require validated header credentials for CSRF exemption (#12185)

2026-09-22 04:35:09 +01:00

csrf.go

test(config): assert every usecase flag is a distinct bit

2026-10-13 08:27:24 +00:00

db_nosqlite.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

db_sqlite_test.go

fix(auth): make advisory locks dialect-aware and harden SQLite DSN (#10509)

2026-06-25 17:18:55 +02:00

db_sqlite.go

fix(auth): make advisory locks dialect-aware and harden SQLite DSN (#10509)

2026-06-25 17:18:55 +02:00

db_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

db.go

feat(usage): track and visualise usage per API key (#9920)

2026-05-21 16:34:02 +02:00

features_decisions_test.go

feat(api): add OpenAI Decisions endpoint (#12603)

2026-10-10 08:29:31 +02:00

features_moderation_test.go

feat(api): add text moderation endpoint (#11316)

2026-08-03 18:03:46 +02:00

features_motion_test.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

features.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

header_auth_test.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

helpers_test.go

feat(failover): expose chain status, pins and events over REST and SSE

2026-09-27 07:42:20 +00:00

middleware_test.go

feat(failover): expose chain status, pins and events over REST and SSE

2026-09-27 07:42:20 +00:00

middleware.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

models.go

feat(auth): let users pause and resume their API keys (#12521)

2026-10-06 18:25:21 +02:00

motion_permissions_test.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

oauth_email_decision_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

oauth_email_decision.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

oauth_signing_algs_test.go

fix(auth): accept EC/PS/EdDSA-signed OIDC ID tokens, not just RS256 (#10736)

2026-07-08 15:24:29 +02:00

oauth.go

fix(auth): accept EC/PS/EdDSA-signed OIDC ID tokens, not just RS256 (#10736)

2026-07-08 15:24:29 +02:00

password_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

password.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

permissions.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

public_routes.go

[ui] Serve canvas HTML previews with their own CSP (#12715)

2026-10-17 00:54:22 +02:00

quota.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

roles_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

roles.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

session_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

session.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

usage_test.go

feat(kimodocpp): track usage through generic backend metadata (#12162)

2026-09-20 19:39:06 +01:00

usage.go

feat(kimodocpp): track usage through generic backend metadata (#12162)

2026-09-20 19:39:06 +01:00

users_test.go

fix(auth): cascade user deletion across all owned data on PostgreSQL (#9702)

2026-05-07 08:28:58 +02:00

users.go

fix(auth): cascade user deletion across all owned data on PostgreSQL (#9702)

2026-05-07 08:28:58 +02:00

websocket_tickets_internal_test.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00

websocket_tickets.go

feat(motion): add GEM-X backend and duplex streaming API

2026-10-13 08:27:24 +00:00