anyproto · ra3orblade · Dec 8, 2023 · Nov 6, 2023 · Nov 6, 2023 · Nov 6, 2023
diff --git a/dist/embed/chart/chart.umd.js b/dist/embed/chart/chart.umd.js
diff --git a/dist/embed/chart/chart.umd.js.map b/dist/embed/chart/chart.umd.js.map
diff --git a/dist/embed/iframe.html b/dist/embed/iframe.html
@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<style type="text/css">
+			* { margin: 0px; padding: 0px; }
+
+			html, body { height: 100%; }
+
+			body { background-color: #fff; }
+			body.dark { background-color: #171717; }
+
+			iframe { width: 100% !important; height: 100% !important; }
+		</style>
+	</head>
+	<body>
+		<script type="text/javascript">
+
+			window.addEventListener('message', e => {
+				if (!e.origin.match(/\/\/localhost:/) && (e.origin !== null)) {
+					return;
+				};
+
+				const body = document.body;
+				const { html, js, theme, libs } = e.data;
+
+				loadLibs(libs, () => {
+					body.innerHTML = html;
+					body.className = theme;
+
+					if (js) {
+						try {
+							eval(js);
+						} catch (e) {
+							console.error(e);
+						};
+					};
+
+					resize(e);
+				});
+			});
+
+			window.addEventListener('resize', resize);
+
+			window.onerror = function (message, url, lineNumber) {  
+				return true;
+			};
+
+			function resize (e) {
+				window.parent.postMessage({ height: document.documentElement.scrollHeight }, '*');
+			};
+
+			function loadLibs (list, callBack) {
+				if (!list.length) {
+					if (callBack) {
+						callBack();
+					};
+					return;
+				};
+
+				const src = list.shift();
+				const script = document.createElement('script');
+
+				document.head.appendChild(script);
+
+				script.onload = function (e) {
+					if (list.length) {
+						loadScripts(list, callBack);
+					} else 
+					if (callBack) {
+						callBack();
+					};
+				};
+
+				script.type = 'text/javascript';
+				script.src = src;
+			};
+		</script>
+	</body>
+</html>
diff --git a/electron.js b/electron.js
@@ -21,17 +21,12 @@ const WindowManager = require('./electron/js/window.js');
 const Server = require('./electron/js/server.js');
 const Util = require('./electron/js/util.js');
 
-const csp = [
-	`default-src 'self' 'unsafe-eval' blob: http://localhost:*`,
-	`img-src 'self' http://*:* https://*:* data: blob: file://*`,
-	`media-src 'self' http://*:* https://*:* data: blob: file://*`,
-	`style-src 'unsafe-inline' http://localhost:* file://*`,
-	`font-src data: file://* http://localhost:*`,
-	`connect-src file://* http://localhost:* http://127.0.0.1:* ws://localhost:* https://*.anytype.io https://api.amplitude.com/ devtools://devtools data:`,
-	`script-src-elem file: http://localhost:* https://sentry.io devtools://devtools 'unsafe-inline'`,
-	`frame-src chrome-extension://react-developer-tools`,
-	`worker-src 'self' 'unsafe-eval' blob: http://localhost:*`,
-];
+const Cors = require('./electron/json/cors.json');
+const csp = [];
+
+for (let i in Cors) {
+	csp.push([ i ].concat(Cors[i]).join(' '));
+};
 
 app.commandLine.appendSwitch('ignore-connections-limit', 'localhost, 127.0.0.1');
 app.removeAsDefaultProtocolClient(protocol);

diff --git a/electron/json/cors.json b/electron/json/cors.json
@@ -0,0 +1,116 @@
+{
+	"default-src": [ 
+		"'self'", 
+		"'unsafe-eval'", 
+		"blob:", 
+		"http://localhost:*" 
+	],
+
+	"img-src": [ 
+		"'self'", 
+		"http://*:*", 
+		"https://*:*", 
+		"data:", 
+		"blob:", 
+		"file://*",
+		"https://*.sndcdn.com"
+	],
+
+	"media-src": [ 
+		"'self'", 
+		"http://*:*", 
+		"https://*:*", 
+		"data:", 
+		"blob:", 
+		"file://*", 
+		"https://*.googlevideo.com" 
+	],
+
+	"style-src": [ 
+		"'unsafe-inline'", 
+		"http://localhost:*", 
+		"file://*", 
+		"https://*.youtube.com", 
+		"https://*.vimeocdn.com",
+		"https://*.gstatic.com",
+		"https://*.googleapis.com",
+		"https://mirostatic.com",
+		"https://miro.com",
+		"https://*.google.com"
+	],
+
+	"font-src": [ 
+		"data:", 
+		"file://*", 
+		"http://localhost:*", 
+		"https://*.youtube.com", 
+		"https://*.vimeocdn.com",
+		"https://*.gstatic.com",
+		"https://mirostatic.com",
+		"https://miro.com"
+	],
+
+	"connect-src": [ 
+		"file://*", 
+		"data:",
+		"http://localhost:*", 
+		"http://127.0.0.1:*",
+		"ws://localhost:*", 
+		"https://*.anytype.io", 
+		"https://api.amplitude.com", 
+		"devtools://devtools", 
+		"https://*.youtube.com",
+		"https://*.vimeocdn.com", 
+		"https://*.vimeo.com", 
+		"https://*.googlevideo.com", 
+		"https://*.akamaized.net",
+		"https://*.soundcloud.com",
+		"https://*.sndcdn.com",
+		"https://*.google.com",
+		"https://*.googleapis.com",
+		"https://*.doubleclick.net",
+		"https://miro.com",
+		"https://*.miro.com",
+		"https://*.cookielaw.org",
+		"https://*.sentry.io",
+		"https://*.split.io",
+		"https://*.onetrust.com",
+		"https://mirostatic.com",
+		"wss://miro.com"
+	],
+
+	"script-src-elem": [
+		"file:",
+		"'unsafe-inline'",
+		"http://localhost:*",
+		"https://sentry.io",
+		"devtools://devtools",
+		"https://*.youtube.com",
+		"https://*.vimeocdn.com",
+		"https://*.gstatic.com",
+		"https://*.sndcdn.com",
+		"https://*.google.com",
+		"https://*.googleapis.com",
+		"https://*.doubleclick.net",
+		"https://*.cookielaw.org",
+		"https://mirostatic.com"
+	],
+
+	"frame-src": [
+		"chrome-extension://react-developer-tools",
+		"http://localhost:*/embed/iframe.html",
+		"https://*.youtube.com",
+		"https://*.vimeo.com",
+		"https://w.soundcloud.com",
+		"https://*.google.com",
+		"https://miro.com",
+		"https://*.miro.com"
+	],
+
+	"worker-src": [ 
+		"'self'", 
+		"'unsafe-eval'", 
+		"blob:", 
+		"http://localhost:*" 
+	]
+}