mirror of
https://github.com/runbear-io/beardrive.git
synced 2026-08-25 08:08:08 +02:00
Snow LeeandClaude Fable 5
cb621c153e
Two viewer features plus the security fix the second one surfaced: - Missing file/folder paths now get a not-found view: the path, and the hint that a just-created file may still be uploading or syncing from a teammate's device — the tree polls every few seconds so it appears on its own, plus a Check again button that refetches immediately. The topbar's share/download actions no longer show for nonexistent files. - Opening an .html file renders it as a page (sandboxed iframe, allow-scripts only) instead of showing source text. - SECURITY: /api/file was already serving synced HTML inline as text/html on the hub origin with session cookies — a stored-XSS surface reachable by direct navigation, previously masked only by the viewer showing HTML as text. Inline HTML and SVG responses now carry 'Content-Security-Policy: sandbox allow-scripts' (the same wall as /s/* share pages); downloads are exempt (attachments never execute in the hub origin). Tests: Go CSP-header matrix (html/svg sandboxed, md clean, download exempt); e2e: sandboxed-iframe rendering incl. in-frame content + CSP assertion, and the not-found → late-upload → Check again flow. 44 specs green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt