diff --git a/app/controllers/discourse_ai/ai_bot/artifacts_controller.rb b/app/controllers/discourse_ai/ai_bot/artifacts_controller.rb index aaec3b268..4e4896595 100644 --- a/app/controllers/discourse_ai/ai_bot/artifacts_controller.rb +++ b/app/controllers/discourse_ai/ai_bot/artifacts_controller.rb @@ -12,7 +12,7 @@ def show artifact = AiArtifact.find(params[:id]) post = Post.find_by(id: artifact.post_id) - if artifact.metadata&.dig("public") + if artifact.public? # no guardian needed else raise Discourse::NotFound if !post&.topic&.private_message? @@ -81,7 +81,7 @@ def show response.headers.delete("X-Frame-Options") response.headers[ "Content-Security-Policy" - ] = "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://unpkg.com https://cdnjs.cloudflare.com https://ajax.googleapis.com https://cdn.jsdelivr.net;" + ] = "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' #{AiArtifact::ALLOWED_CDN_SOURCES.join(" ")};" response.headers["X-Robots-Tag"] = "noindex" # Render the content diff --git a/app/models/ai_artifact.rb b/app/models/ai_artifact.rb index 355e8384e..f3faddb30 100644 --- a/app/models/ai_artifact.rb +++ b/app/models/ai_artifact.rb @@ -8,6 +8,15 @@ class AiArtifact < ActiveRecord::Base validates :css, length: { maximum: 65_535 } validates :js, length: { maximum: 65_535 } + ALLOWED_CDN_SOURCES = %w[ + https://cdn.jsdelivr.net + https://cdnjs.cloudflare.com + https://unpkg.com + https://ajax.googleapis.com + https://d3js.org + https://code.jquery.com + ] + def self.iframe_for(id, version = nil) <<~HTML
Some text
-Some text
- +Some new text
-Some new text
-Some text
- +Some new text
- @@ -5,3 +5,3 @@ - -more text
-