Jayden/AFFiNE-Mirror
0
0
Fork 0
mirror of https://github.com/toeverything/AFFiNE.git synced 2026-09-07 01:09:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(editor): add credentialless attribute to iframe for COEP compliance (#12161)

Browse Source 
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->

## Summary by CodeRabbit

- **New Features**
  - Added enhanced privacy controls by including the `credentialless` attribute to embedded content iframes for PDF, Figma, Loom, YouTube, and generic iframe blocks. This helps improve security and privacy when displaying embedded content.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
donteatfriedrice
2025-05-07 04:01:57 +00:00
parent af7cbdaf7e
commit 0a9f5a1da9
5 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blocksuite/affine/blocks/attachment/src/embed.ts
+1
View File
@@ -157,6 +157,7 @@ const embedConfig: AttachmentEmbedConfig[] = [
allowTransparency allowTransparency
allowfullscreen allowfullscreen
type="application/pdf" type="application/pdf"
credentialless
></iframe> ></iframe>
<div class="affine-attachment-embed-event-mask"></div> <div class="affine-attachment-embed-event-mask"></div>
`; `;
blocksuite/affine/blocks/embed/src/embed-figma-block/embed-figma-block.ts
+1
View File
@@ -89,6 +89,7 @@ export class EmbedFigmaBlockComponent extends EmbedBlockComponent<EmbedFigmaMode
src=${`https://www.figma.com/embed?embed_host=blocksuite&url=${url}`} src=${`https://www.figma.com/embed?embed_host=blocksuite&url=${url}`}
allowfullscreen allowfullscreen
loading="lazy" loading="lazy"
credentialless
></iframe> ></iframe>
<!-- overlay to prevent the iframe from capturing pointer events --> <!-- overlay to prevent the iframe from capturing pointer events -->
blocksuite/affine/blocks/embed/src/embed-iframe-block/embed-iframe-block.ts
+1
View File
@@ -311,6 +311,7 @@ export class EmbedIframeBlockComponent extends CaptionedBlockComponent<EmbedIfra
?allowfullscreen=${allowFullscreen} ?allowfullscreen=${allowFullscreen}
loading="lazy" loading="lazy"
frameborder="0" frameborder="0"
credentialless
src=${ifDefined(iframeUrl)} src=${ifDefined(iframeUrl)}
allow=${ifDefined(allow)} allow=${ifDefined(allow)}
referrerpolicy=${ifDefined(referrerpolicy)} referrerpolicy=${ifDefined(referrerpolicy)}
blocksuite/affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts
+1
View File
@@ -127,6 +127,7 @@ export class EmbedLoomBlockComponent extends EmbedBlockComponent<
frameborder="0" frameborder="0"
allow="fullscreen; accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allow="fullscreen; accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
loading="lazy" loading="lazy"
credentialless
></iframe> ></iframe>
<!-- overlay to prevent the iframe from capturing pointer events --> <!-- overlay to prevent the iframe from capturing pointer events -->
blocksuite/affine/blocks/embed/src/embed-youtube-block/embed-youtube-block.ts
+1
View File
@@ -151,6 +151,7 @@ export class EmbedYoutubeBlockComponent extends EmbedBlockComponent<
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
allowfullscreen allowfullscreen
loading="lazy" loading="lazy"
credentialless
></iframe> ></iframe>
<!-- overlay to prevent the iframe from capturing pointer events --> <!-- overlay to prevent the iframe from capturing pointer events -->