Prevent navigation in preview panel marketing header links - #581
Conversation
…iframe The nav's href="#" links could still let the sandboxed preview iframe navigate itself (allow-same-origin is required for contentDocument access), recursively loading the whole configurator app inside the tiny preview pane. Prevent default on click so they never navigate.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe marketing preview template's navigation anchors (Framework, Tokens, Docs) were updated to include ChangesPreview navigation fix
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary
Added
onclick="event.preventDefault()"handlers to the navigation links in the preview panel's marketing header to prevent the iframe from navigating to the app's own origin.Changes
onclick="event.preventDefault()"to three navigation links (Framework,Tokens,Docs) in theMARKETING_BODYHTML templateallow-same-origin(required forcontentDocumentaccess), which would otherwise allow real hrefs to navigate the frame itself, causing the configurator to load recursively inside the tiny preview paneImplementation details
The preview iframe retains
allow-same-originfor legitimate functionality (accessing the iframe'scontentDocument), but this creates a side effect where navigation links would cause the frame to navigate to the app's own origin. By preventing default link behavior on these marketing navigation elements, we avoid this unintended recursive loading while maintaining the iframe's necessary same-origin access.https://claude.ai/code/session_01UgZiZAV7HwRbuD9jyDi633
Summary by CodeRabbit