mirror of
https://github.com/THU-MAIC/OpenMAIC.git
synced 2026-10-17 05:29:46 +08:00
Combining allow-scripts with allow-same-origin on a srcDoc iframe negates the sandbox; since the embedded HTML can come from LLM output or imported data, the iframe now runs in a null origin. postMessage control (targetOrigin='*') is unaffected. Adds a regression test. Fixes #725.