From 60b002f1eac2d83fb8f953df78427c0aa0c3a705 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
<66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Mon, 25 May 2026 14:00:40 +0000
Subject: [PATCH] [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---
studio/backend/routes/html_preview.py | 62 +++++++++++------------
studio/backend/tests/test_html_preview.py | 5 +-
2 files changed, 33 insertions(+), 34 deletions(-)
diff --git a/studio/backend/routes/html_preview.py b/studio/backend/routes/html_preview.py
index e17ae5de53..f30064c4c3 100644
--- a/studio/backend/routes/html_preview.py
+++ b/studio/backend/routes/html_preview.py
@@ -99,39 +99,37 @@ def _build_html_doc(source: str) -> str:
# ```` mirrors the srcdoc fallback so any ````
# without an explicit target opens in a new tab rather than navigating
# the iframe (which would be UX-confusing).
- return (
- ""
- ''
- + source
+ return "" '' + source
+
+
+_PREVIEW_CSP = "; ".join(
+ (
+ "default-src 'none'",
+ # ``script-src 'unsafe-inline'`` enables BOTH ``