Revert "Remove frame-src CSP to allow tunnel access"

This reverts commit 2196fa2.
James-Yu · Oct 5, 2024 · ab0e003 · ab0e003
1 parent 2196fa2
commit ab0e003
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/preview/viewer/pdfviewerpanel.ts b/src/preview/viewer/pdfviewerpanel.ts
@@ -120,7 +120,7 @@ async function getPDFViewerContent(pdfUri: vscode.Uri): Promise<string> {
     logger.log(`Internal PDF viewer at ${iframeSrcUrl} .`)
     const rebroadcast: boolean = getKeyboardEventConfig()
     return `
-    <!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline';"></head>
+    <!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; frame-src ${iframeSrcOrigin}; script-src 'unsafe-inline'; style-src 'unsafe-inline';"></head>
     <body><iframe id="preview-panel" class="preview-panel" src="${iframeSrcUrl}" style="position:absolute; border: none; left: 0; top: 0; width: 100%; height: 100%;">
     </iframe>
     <script>