(nifi) branch main updated: NIFI-15537 - Set appropriate sandbox and referrerpolicy to use with custom UI iframes

[pvillard]

This is an automated email from the ASF dual-hosted git repository.

pvillard pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git


The following commit(s) were added to refs/heads/main by this push:
     new 2bddbbb9a4 NIFI-15537 - Set appropriate sandbox and referrerpolicy to 
use with custom UI iframes
2bddbbb9a4 is described below

commit 2bddbbb9a43deda98b8b295ad305a9fbdce4ca85
Author: Rob Fellows <rob.fell...@gmail.com>
AuthorDate: Mon Feb 2 15:58:53 2026 -0500

    NIFI-15537 - Set appropriate sandbox and referrerpolicy to use with custom 
UI iframes
    
    This closes #10842.
    
    Signed-off-by: Pierre Villard <pierre.villard...@gmail.com>
---
 .../ui/external-viewer/external-viewer.component.html               | 4 ++++
 .../nifi/src/app/ui/common/advanced-ui/advanced-ui.component.html   | 3 +++
 .../ui/common/tooltips/bulletins-tip/bulletins-tip.component.html   | 4 +---
 nifi-frontend/src/main/frontend/package-lock.json                   | 6 +++---
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/content-viewer/ui/external-viewer/external-viewer.component.html
 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/content-viewer/ui/external-viewer/external-viewer.component.html
index 2fe40eace3..b8474f24ca 100644
--- 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/content-viewer/ui/external-viewer/external-viewer.component.html
+++ 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/content-viewer/ui/external-viewer/external-viewer.component.html
@@ -16,10 +16,14 @@
   -->
 
 @if (frameSource) {
+    <!-- Sandbox omits allow-forms because this is a read-only content viewer 
-->
     <iframe
         #iframeRef
         class="h-full w-full"
         [src]="frameSource"
+        title="External content viewer"
+        sandbox="allow-scripts allow-same-origin"
+        referrerpolicy="strict-origin-when-cross-origin"
         *recreateView="frameSource"
         (load)="systemTokensService.appendStyleSheet(iframeRef)"></iframe>
 }
diff --git 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/advanced-ui/advanced-ui.component.html
 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/advanced-ui/advanced-ui.component.html
index 6bb9126384..b0c96f293e 100644
--- 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/advanced-ui/advanced-ui.component.html
+++ 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/advanced-ui/advanced-ui.component.html
@@ -25,6 +25,9 @@
                 #iframeRef
                 class="flex-1"
                 [src]="frameSource"
+                title="Advanced configuration UI"
+                sandbox="allow-scripts allow-forms allow-same-origin"
+                referrerpolicy="strict-origin-when-cross-origin"
                 
(load)="systemTokensService.appendStyleSheet(iframeRef)"></iframe>
         } @else {
             <div>Unable to open Advanced configuration UI.</div>
diff --git 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/tooltips/bulletins-tip/bulletins-tip.component.html
 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/tooltips/bulletins-tip/bulletins-tip.component.html
index 53f86ba576..5b552c1905 100644
--- 
a/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/tooltips/bulletins-tip/bulletins-tip.component.html
+++ 
b/nifi-frontend/src/main/frontend/apps/nifi/src/app/ui/common/tooltips/bulletins-tip/bulletins-tip.component.html
@@ -30,9 +30,7 @@
                                 {{ bulletinEntity.bulletin.level }}
                             </div>
                         </div>
-                        <pre class="whitespace-pre-wrap">{{
-                            bulletinEntity.bulletin.message
-                        }}</pre>
+                        <pre class="whitespace-pre-wrap">{{ 
bulletinEntity.bulletin.message }}</pre>
                     </div>
                 </li>
             }
diff --git a/nifi-frontend/src/main/frontend/package-lock.json 
b/nifi-frontend/src/main/frontend/package-lock.json
index 2fe1bed37b..1f8beea054 100644
--- a/nifi-frontend/src/main/frontend/package-lock.json
+++ b/nifi-frontend/src/main/frontend/package-lock.json
@@ -31300,9 +31300,9 @@
             }
         },
         "node_modules/tar": {
-            "version": "7.5.6",
-            "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.6.tgz";,
-            "integrity": 
"sha512-xqUeu2JAIJpXyvskvU3uvQW8PAmHrtXp2KDuMJwQqW8Sqq0CaZBAQ+dKS3RBXVhU4wC5NjAdKrmh84241gO9cA==",
+            "version": "7.5.7",
+            "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.7.tgz";,
+            "integrity": 
"sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==",
             "dev": true,
             "license": "BlueOak-1.0.0",
             "dependencies": {