modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: follow-up to PR #234 (remove accidental file, revert from document.write to equiv. srcdoc) (#248)

Browse source 
* chore: remove tamper-detection.ts (not meant to be submitted)

Follow-up to PR #234. This file was accidentally included.

* revert to srcdoc

Follow-up to PR #234 per domfarolino's review feedback.

* regen

* regen
This commit is contained in:
Olivier Chafik 2026-01-12 22:19:31 +00:00 • committed by GitHub
commit ba550f1aeb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 343 deletions
Download patch file Download diff file Expand all files Collapse all files

18
examples/basic-host/src/sandbox.ts
View file

@ -95,21 +95,9 @@ window.addEventListener("message", async (event) => {
inner.setAttribute("allow", allowAttribute);
}
if (typeof html === "string") {
// Use document.write instead of srcdoc for WebGL compatibility.
// srcdoc creates an opaque origin which prevents WebGL canvas updates
// from being displayed properly. document.write preserves the sandbox
// origin, allowing WebGL to work correctly.
// CSP is enforced via HTTP headers on this page (sandbox.html).
const doc = inner.contentDocument || inner.contentWindow?.document;
if (doc) {
doc.open();
doc.write(html);
doc.close();
} else {
// Fallback to srcdoc if document is not accessible
console.warn("[Sandbox] document.write not available, falling back to srcdoc");
inner.srcdoc = html;
}
inner.srcdoc = html;
} else {
console.error("[Sandbox] Missing or invalid HTML content in sandbox-resource-ready notification.");
}
} else {
if (inner && inner.contentWindow) {