@@ -17,19 +17,22 @@ import { decode } from "he";
17
17
// - if it starts with iframe
18
18
// - if it has a whole page doctype
19
19
// - if it has a <script> tag anywhere without a type -- since those are ignored by safe HTML
20
- // rendering; using an iframe is the only way. This e.g., makes mpld3 work! https://github.com/sagemathinc/cocalc/issues/1934
20
+ // rendering; using an iframe is the only way. This e.g., makes mpld3 work uses -- <script>! https://github.com/sagemathinc/cocalc/issues/1934
21
+ // and altair -- https://github.com/sagemathinc/cocalc/issues/4468 -- uses <script type="text/javascript"/>
22
+ // - do NOT just render all html in an iframe, e.g., this would break bokeh, since one output creates the target elt,
23
+ // and a different output uses javascript to render it, and this doesn't work with an iframe, of course.
21
24
export function is_likely_iframe ( content : string ) : boolean {
22
25
if ( ! content ) {
23
26
return false ;
24
27
}
25
- content = content . slice ( 0 , 100 ) . trim ( ) . toLowerCase ( ) ;
28
+ content = content . toLowerCase ( ) ;
26
29
return (
30
+ content . includes ( "bk-notebook-logo" ) ||
27
31
content . startsWith ( "<iframe" ) ||
28
32
content . includes ( "<!doctype html>" ) ||
29
33
( content . includes ( "<html>" ) && content . includes ( "<head>" ) ) ||
30
- // special case "altair" inline html -- https://github.com/sagemathinc/cocalc/issues/4468
31
- content . includes ( 'id="altair-viz-' ) ||
32
- content . includes ( "<script>" )
34
+ content . includes ( "<script>" ) ||
35
+ content . includes ( '<script type="text/javascript">' )
33
36
) ;
34
37
}
35
38
0 commit comments