From 4f24faa33385585406b25a7ec049747ea16a00c4 Mon Sep 17 00:00:00 2001 From: Gavin Barron Date: Wed, 20 May 2026 09:25:58 -0700 Subject: [PATCH] fix: add sandbox and CSP to playground preview iframe Closes #3488 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../addons/codeEditorAddon/codeAddon.js | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.storybook/addons/codeEditorAddon/codeAddon.js b/.storybook/addons/codeEditorAddon/codeAddon.js index 44b8366c6a..b19f2aefbc 100644 --- a/.storybook/addons/codeEditorAddon/codeAddon.js +++ b/.storybook/addons/codeEditorAddon/codeAddon.js @@ -228,6 +228,14 @@ export const withCodeEditor = makeDecorator({ const loadEditorContent = () => { const storyElement = document.createElement('iframe'); + // Security: sandbox the iframe to restrict capabilities. + // allow-same-origin is required for ES module loading; exfiltration is + // blocked by the CSP meta tag injected below. + storyElement.setAttribute( + 'sandbox', + 'allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-forms' + ); + storyElement.addEventListener( 'load', () => { @@ -242,6 +250,18 @@ export const withCodeEditor = makeDecorator({ const docContent = ` +