fix(annotate): strip document-authored CSP meta tags that block the annotation bridge - #1259
Merged
Conversation
…ge can run A document carrying its own <meta http-equiv=Content-Security-Policy> (including Plannotator's own portable guided-review exports, which embed default-src 'none') blocked the injected inline bridge script, disabling annotation entirely for that file. The iframe sandbox attribute is the annotate surface's security boundary; the page's CSP was authored for its standalone context, so injectIntoHead now strips CSP meta tags (order/quote/case tolerant) before splicing the bridge. Pre-existing bug, surfaced during v0.26.8 manual QA. Mutation-verified test.
juliosantoyo97-ai
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR: A document that ships its own CSP meta tag (including Plannotator's own portable guided-review HTML exports, which embed
default-src 'none') blocked the injected inline annotation bridge, so annotating such a file did nothing at all: no pinpoint, no selection.injectIntoHeadnow strips document-authored CSP meta tags before splicing the bridge. Pre-existing bug, found in v0.26.8 manual QA when annotating one of our own exports.The iframe
sandboxattribute is the annotate surface's actual security boundary; the page's CSP was authored for its standalone context, so removing it inside the viewer does not weaken anything. The removal is tolerant of attribute order, quoting, casing, and self-closing forms; otherhttp-equivmetas and the rest of the head are untouched. A replacement comment marks the removal in the assembled srcdoc.Validation: new regression test covering the exact exported tag plus variants, mutation-verified (neutralization disabled makes it fail); srcdoc suite 74 pass; typecheck clean.