ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[pre-commit.ci] auto fixes from pre-commit.com hooks

Browse source 
for more information, see https://pre-commit.ci
This commit is contained in:
pre-commit-ci[bot] 2026-05-25 14:00:40 +00:00
commit 60b002f1ea
2 changed files with 33 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

62
studio/backend/routes/html_preview.py
View file

@ -99,39 +99,37 @@ def _build_html_doc(source: str) -> str:
# ``<base target="_blank">`` mirrors the srcdoc fallback so any ``<a>``
# without an explicit target opens in a new tab rather than navigating
# the iframe (which would be UX-confusing).
return (
"<!doctype html>"
'<base target="_blank">'
+ source
return "<!doctype html>" '<base target="_blank">' + source
_PREVIEW_CSP = "; ".join(
(
"default-src 'none'",
# ``script-src 'unsafe-inline'`` enables BOTH ``<script>`` blocks and
# ``onclick``-style attribute handlers. This is the entire reason the
# route exists -- the host page's ``script-src 'self'`` does not.
"script-src 'unsafe-inline'",
"style-src 'unsafe-inline'",
# ``data:`` / ``blob:`` only, NOT remote http(s). Inline JS cannot
# exfiltrate by fetching a remote pixel since ``connect-src 'none'``
# blocks fetch/XHR, but stripping remote ``img-src`` removes the
# other classic beacon vector too.
"img-src data: blob:",
"media-src data: blob:",
"font-src data:",
"connect-src 'none'",
"worker-src 'none'",
"frame-src 'none'",
"object-src 'none'",
"base-uri 'none'",
"form-action 'none'",
# Restrict who can embed THIS preview. The Studio host page is
# same-origin and is the only legitimate embedder. ``frame-ancestors
# 'self'`` also overrides any global X-Frame-Options on modern
# browsers, so a third-party site cannot iframe a leaked preview URL.
"frame-ancestors 'self'",
)
_PREVIEW_CSP = "; ".join((
"default-src 'none'",
# ``script-src 'unsafe-inline'`` enables BOTH ``<script>`` blocks and
# ``onclick``-style attribute handlers. This is the entire reason the
# route exists -- the host page's ``script-src 'self'`` does not.
"script-src 'unsafe-inline'",
"style-src 'unsafe-inline'",
# ``data:`` / ``blob:`` only, NOT remote http(s). Inline JS cannot
# exfiltrate by fetching a remote pixel since ``connect-src 'none'``
# blocks fetch/XHR, but stripping remote ``img-src`` removes the
# other classic beacon vector too.
"img-src data: blob:",
"media-src data: blob:",
"font-src data:",
"connect-src 'none'",
"worker-src 'none'",
"frame-src 'none'",
"object-src 'none'",
"base-uri 'none'",
"form-action 'none'",
# Restrict who can embed THIS preview. The Studio host page is
# same-origin and is the only legitimate embedder. ``frame-ancestors
# 'self'`` also overrides any global X-Frame-Options on modern
# browsers, so a third-party site cannot iframe a leaked preview URL.
"frame-ancestors 'self'",
))
)
# ---------------------------------------------------------------------------

5
studio/backend/tests/test_html_preview.py
View file

@ -28,6 +28,7 @@ def preview_app(tmp_path, monkeypatch):
monkeypatch.setattr(storage, "_bootstrap_password", None)
import secrets as _secrets
storage.create_initial_user(
username = storage.DEFAULT_ADMIN_USERNAME,
password = "human-password-123",
@ -120,7 +121,7 @@ class TestGetHtmlPreview:
body = r.text
# The doctype + base + body are present.
assert "<!doctype html>" in body.lower()
assert "<base target=\"_blank\">" in body
assert '<base target="_blank">' in body
assert "<button onclick=\"alert('x')\">go</button>" in body
# The overriding CSP must permit inline script execution.
csp = r.headers["content-security-policy"]
@ -194,6 +195,6 @@ class TestEviction:
token_id = old.rsplit("/", 1)[-1]
assert token_id not in mod._PREVIEWS
# Newer tokens are still present.
for fresh in urls[-mod.MAX_LIVE_PREVIEWS:]:
for fresh in urls[-mod.MAX_LIVE_PREVIEWS :]:
token_id = fresh.rsplit("/", 1)[-1]
assert token_id in mod._PREVIEWS