{ "version": 3, "sources": ["../../src/sandbox/index.tsx"], "sourcesContent": ["/**\n * WordPress dependencies\n */\nimport { renderToString, useRef, useState, useEffect, useMemo } from '@wordpress/element';\nimport { useFocusableIframe, useMergeRefs } from '@wordpress/compose';\n\n/**\n * Internal dependencies\n */\nimport { jsx as _jsx, jsxs as _jsxs } from \"react/jsx-runtime\";\nconst observeAndResizeJS = function () {\n const {\n MutationObserver\n } = window;\n if (!MutationObserver || !document.body || !window.parent) {\n return;\n }\n function sendResize() {\n const clientBoundingRect = document.body.getBoundingClientRect();\n window.parent.postMessage({\n action: 'resize',\n width: clientBoundingRect.width,\n height: clientBoundingRect.height\n }, '*');\n }\n const observer = new MutationObserver(sendResize);\n observer.observe(document.body, {\n attributes: true,\n attributeOldValue: false,\n characterData: true,\n characterDataOldValue: false,\n childList: true,\n subtree: true\n });\n window.addEventListener('load', sendResize, true);\n\n // Hack: Remove viewport unit styles, as these are relative\n // the iframe root and interfere with our mechanism for\n // determining the unconstrained page bounds.\n function removeViewportStyles(ruleOrNode) {\n if (ruleOrNode.style) {\n ['width', 'height', 'minHeight', 'maxHeight'].forEach(function (style) {\n if (/^\\\\d+(vw|vh|svw|lvw|dvw|svh|lvh|dvh|vi|svi|lvi|dvi|vb|svb|lvb|dvb|vmin|svmin|lvmin|dvmin|vmax|svmax|lvmax|dvmax)$/.test(ruleOrNode.style[style])) {\n ruleOrNode.style[style] = '';\n }\n });\n }\n }\n Array.prototype.forEach.call(document.querySelectorAll('[style]'), removeViewportStyles);\n Array.prototype.forEach.call(document.styleSheets, function (stylesheet) {\n Array.prototype.forEach.call(stylesheet.cssRules || stylesheet.rules, removeViewportStyles);\n });\n document.body.style.position = 'absolute';\n document.body.style.width = '100%';\n document.body.setAttribute('data-resizable-iframe-connected', '');\n sendResize();\n\n // Resize events can change the width of elements with 100% width, but we don't\n // get an DOM mutations for that, so do the resize when the window is resized, too.\n window.addEventListener('resize', sendResize, true);\n};\n\n// TODO: These styles shouldn't be coupled with WordPress.\nconst style = `\n\tbody {\n\t\tmargin: 0;\n\t}\n\thtml,\n\tbody,\n\tbody > div {\n\t\twidth: 100%;\n\t}\n\thtml.wp-has-aspect-ratio,\n\tbody.wp-has-aspect-ratio,\n\tbody.wp-has-aspect-ratio > div,\n\tbody.wp-has-aspect-ratio > div iframe {\n\t\twidth: 100%;\n\t\theight: 100%;\n\t\toverflow: hidden; /* If it has an aspect ratio, it shouldn't scroll. */\n\t}\n\tbody > div > * {\n\t\tmargin-top: 0 !important; /* Has to have !important to override inline styles. */\n\t\tmargin-bottom: 0 !important;\n\t}\n`;\n\n/**\n * Builds the full HTML document string for the sandbox iframe content.\n */\nfunction buildSandBoxDocument({\n html,\n title,\n type,\n styles,\n scripts\n}) {\n const htmlDoc = /*#__PURE__*/_jsxs(\"html\", {\n lang: document.documentElement.lang,\n className: type,\n children: [/*#__PURE__*/_jsxs(\"head\", {\n children: [/*#__PURE__*/_jsx(\"title\", {\n children: title\n }), /*#__PURE__*/_jsx(\"style\", {\n dangerouslySetInnerHTML: {\n __html: style\n }\n }), styles.map((rules, i) => /*#__PURE__*/_jsx(\"style\", {\n dangerouslySetInnerHTML: {\n __html: rules\n }\n }, i))]\n }), /*#__PURE__*/_jsxs(\"body\", {\n \"data-resizable-iframe-connected\": \"data-resizable-iframe-connected\",\n className: type,\n children: [/*#__PURE__*/_jsx(\"div\", {\n dangerouslySetInnerHTML: {\n __html: html\n }\n }), /*#__PURE__*/_jsx(\"script\", {\n type: \"text/javascript\",\n dangerouslySetInnerHTML: {\n __html: `(${observeAndResizeJS.toString()})();`\n }\n }), scripts.map(src => /*#__PURE__*/_jsx(\"script\", {\n src: src\n }, src))]\n })]\n });\n return '' + renderToString(htmlDoc);\n}\n\n/**\n * Isolated sandbox that uses the `srcdoc` attribute to render content\n * without `allow-same-origin`. This is the default for user-controlled\n * content (e.g., the HTML block) where same-origin access would be a\n * security risk.\n *\n * Because `srcdoc` is a declarative attribute, the browser automatically\n * re-renders the content when the iframe is moved in the DOM (e.g.,\n * block reordering), so no `load` event listener is needed.\n * The `message` listener is re-synced on every `load` so\n * it follows the iframe if it's reparented into a different document.\n */\nfunction IsolatedSandBox({\n html = '',\n title = '',\n type,\n styles = [],\n scripts = [],\n onFocus,\n tabIndex\n}) {\n const ref = useRef(null);\n const [width, setWidth] = useState(0);\n const [height, setHeight] = useState(0);\n const srcDoc = useMemo(() => buildSandBoxDocument({\n html,\n title,\n type,\n styles,\n scripts\n }), [html, title, type, styles, scripts]);\n useEffect(() => {\n const iframe = ref.current;\n if (!iframe) {\n return;\n }\n function checkMessageForResize(event) {\n // Verify that the mounted element is the source of the message.\n // iframe.contentWindow is accessible cross-origin as a\n // WindowProxy reference, so this check still works without\n // allow-same-origin.\n if (!iframe || iframe.contentWindow !== event.source) {\n return;\n }\n\n // Attempt to parse the message data as JSON if passed as string.\n let data = event.data || {};\n if ('string' === typeof data) {\n try {\n data = JSON.parse(data);\n } catch {}\n }\n\n // Update the state only if the message is formatted as we expect,\n // i.e. as an object with a 'resize' action.\n if ('resize' !== data.action) {\n return;\n }\n setWidth(data.width);\n setHeight(data.height);\n }\n let currentView = null;\n function syncListener() {\n const view = iframe?.ownerDocument?.defaultView ?? null;\n if (view === currentView) {\n return;\n }\n currentView?.removeEventListener('message', checkMessageForResize);\n currentView = view;\n currentView?.addEventListener('message', checkMessageForResize);\n }\n syncListener();\n iframe.addEventListener('load', syncListener);\n return () => {\n iframe.removeEventListener('load', syncListener);\n currentView?.removeEventListener('message', checkMessageForResize);\n };\n }, []);\n return /*#__PURE__*/_jsx(\"iframe\", {\n ref: useMergeRefs([ref, useFocusableIframe()]),\n title: title,\n tabIndex: tabIndex,\n className: \"components-sandbox\",\n sandbox: \"allow-scripts allow-presentation\",\n srcDoc: srcDoc,\n onFocus: onFocus,\n width: Math.ceil(width),\n height: Math.ceil(height)\n });\n}\n\n/**\n * Same-origin sandbox that writes to `contentDocument` directly. This\n * preserves the parent page's URL as the iframe's document URL, which\n * provides a valid Referer header for nested iframes (required by\n * providers like YouTube).\n *\n * Only used when `allowSameOrigin` is true \u2014 i.e., for server-fetched\n * oEmbed previews that are not directly user-controlled.\n *\n * This implementation is intentionally kept close to the original\n * pre-refactor code to preserve past bugfixes:\n * - load listener for iframe re-initialization after DOM moves (#21916)\n * - forceRerender guard to avoid unnecessary full rewrites (#20176)\n */\nfunction SameOriginSandBox({\n html = '',\n title = '',\n type,\n styles = [],\n scripts = [],\n onFocus,\n tabIndex\n}) {\n const ref = useRef(null);\n const [width, setWidth] = useState(0);\n const [height, setHeight] = useState(0);\n function isFrameAccessible() {\n try {\n return !!ref.current?.contentDocument?.body;\n } catch {\n return false;\n }\n }\n function trySandBox(forceRerender = false) {\n if (!isFrameAccessible()) {\n return;\n }\n const {\n contentDocument,\n ownerDocument\n } = ref.current;\n if (!forceRerender && null !== contentDocument?.body.getAttribute('data-resizable-iframe-connected')) {\n return;\n }\n\n // Put the html snippet into a html document, and then write it to the iframe's document\n // we can use this in the future to inject custom styles or scripts.\n // Scripts go into the body rather than the head, to support embedded content such as Instagram\n // that expect the scripts to be part of the body.\n const htmlDoc = /*#__PURE__*/_jsxs(\"html\", {\n lang: ownerDocument.documentElement.lang,\n className: type,\n children: [/*#__PURE__*/_jsxs(\"head\", {\n children: [/*#__PURE__*/_jsx(\"title\", {\n children: title\n }), /*#__PURE__*/_jsx(\"style\", {\n dangerouslySetInnerHTML: {\n __html: style\n }\n }), styles.map((rules, i) => /*#__PURE__*/_jsx(\"style\", {\n dangerouslySetInnerHTML: {\n __html: rules\n }\n }, i))]\n }), /*#__PURE__*/_jsxs(\"body\", {\n \"data-resizable-iframe-connected\": \"data-resizable-iframe-connected\",\n className: type,\n children: [/*#__PURE__*/_jsx(\"div\", {\n dangerouslySetInnerHTML: {\n __html: html\n }\n }), /*#__PURE__*/_jsx(\"script\", {\n type: \"text/javascript\",\n dangerouslySetInnerHTML: {\n __html: `(${observeAndResizeJS.toString()})();`\n }\n }), scripts.map(src => /*#__PURE__*/_jsx(\"script\", {\n src: src\n }, src))]\n })]\n });\n\n // Writing the document like this makes it act in the same way as if it was\n // loaded over the network, so DOM creation and mutation, script execution, etc.\n // all work as expected.\n contentDocument.open();\n contentDocument.write('' + renderToString(htmlDoc));\n contentDocument.close();\n }\n useEffect(() => {\n trySandBox();\n function tryNoForceSandBox() {\n trySandBox(false);\n }\n function checkMessageForResize(event) {\n const iframe = ref.current;\n\n // Verify that the mounted element is the source of the message.\n if (!iframe || iframe.contentWindow !== event.source) {\n return;\n }\n\n // Attempt to parse the message data as JSON if passed as string.\n let data = event.data || {};\n if ('string' === typeof data) {\n try {\n data = JSON.parse(data);\n } catch {}\n }\n\n // Update the state only if the message is formatted as we expect,\n // i.e. as an object with a 'resize' action.\n if ('resize' !== data.action) {\n return;\n }\n setWidth(data.width);\n setHeight(data.height);\n }\n const iframe = ref.current;\n const defaultView = iframe?.ownerDocument?.defaultView;\n\n // This used to be registered using