From 9d219e9c8c1417f952c3fefec6e889c4ff84b368 Mon Sep 17 00:00:00 2001 From: officer Date: Wed, 19 Aug 2026 09:20:40 +0000 Subject: [PATCH] drop the sandbox attribute, which was doing nothing Gitea needs allow-same-origin to keep a session and allow-scripts for the interface to work, and those two together give back everything sandbox takes away. The browser says so on every load: "an iframe which has both allow-scripts and allow-same-origin can escape its sandboxing." So it was decoration that emitted a warning nobody can act on, which is how people learn to ignore warnings. What actually stands here is that this is Gitea's own interface, on the platform's own origin, through a proxy the platform wrote. --- web/GiteaFrame.tsx | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/web/GiteaFrame.tsx b/web/GiteaFrame.tsx index 546f6d5..677fdb0 100644 --- a/web/GiteaFrame.tsx +++ b/web/GiteaFrame.tsx @@ -105,9 +105,16 @@ export const GiteaFrame = () => { src={FRAME_SRC} title="Gitea" className="h-full w-full border-0" - // Same origin, so `allow-same-origin` is what lets Gitea keep its session at all. Scripts and - // forms are Gitea's own — this is its interface, not untrusted content. - sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-downloads" + // NO `sandbox`, deliberately. + // + // It needs `allow-same-origin` for Gitea to keep a session and `allow-scripts` for the interface + // to work at all — and those two together give back everything the attribute takes away. The + // browser says so itself: "an iframe which has both allow-scripts and allow-same-origin can + // escape its sandboxing." + // + // So it was decoration that emitted a warning on every load, and a warning nobody can act on + // teaches people to ignore warnings. What actually stands here is that this is Gitea's own + // interface on the platform's own origin, reached through a proxy the platform wrote. /> );