ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Studio: restrict artifact frame embedding to same-origin

Browse source
This commit is contained in:
wasimysaid 2026-05-26 00:04:25 +02:00
commit 388128ef45
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
studio/backend/routes/inference.py
View file

@ -250,6 +250,7 @@ _ARTIFACT_PREVIEW_FRAME_CSP = (
"object-src 'none'; "
"base-uri 'none'; "
"form-action 'none'; "
"frame-ancestors 'self'; "
"sandbox allow-scripts"
)
_ARTIFACT_PREVIEW_FRAME_HTML = """<!doctype html>
@ -286,6 +287,10 @@ async def artifact_preview_frame():
"Content-Security-Policy": _ARTIFACT_PREVIEW_FRAME_CSP,
"Referrer-Policy": "no-referrer",
"X-Content-Type-Options": "nosniff",
# SAMEORIGIN for browsers that ignore frame-ancestors; the
# SecurityHeadersMiddleware uses setdefault so this takes
# precedence over the global DENY.
"X-Frame-Options": "SAMEORIGIN",
},
)