vscode/src/vs/code/electron-sandbox/workbench/workbench.html

<!-- Copyright (C) Microsoft Corporation. All rights reserved. -->
<!DOCTYPE html>
<html>
	<head>
		<meta charset="utf-8" />
		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'none'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">
		<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types TrustedFunctionWorkaround ExtensionScripts amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget editorGhostText domLineBreaksComputer editorViewLayer diffReview extensionHostWorker dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString webNestedWorkerExtensionHost;">
	</head>
	<body aria-label="">
	</body>

	<!-- Init Bootstrap Helpers -->
	<script src="../../../../bootstrap.js"></script>
	<script src="../../../../vs/loader.js"></script>
	<script src="../../../../bootstrap-window.js"></script>

	<!-- Startup via workbench.js -->
	<script src="workbench.js"></script>
</html>
sandbox - allow to bring up a minimal workbench with simple services and in-memory file-system 2020-08-26 08:32:19 +02:00			`<!-- Copyright (C) Microsoft Corporation. All rights reserved. -->`
			`<!DOCTYPE html>`
			`<html>`
			`<head>`
			`<meta charset="utf-8" />`
Remove vscode-webview-test from electron csp On desktop, we now use a custom protocol to serve all webview resources so this should no longer be required 2021-03-30 23:37:47 +02:00			`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'none'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">`
Switch to dompurify for sanitizing markdown content (#131950) * Switch to dompurify for sanitizing markdown content Switches us from using `insane` to instead use `dompurify`, which seems to be better maintained and also has some nice features, such as built-in trusted types support I've tried to port over our existing sanitizer settings as best as possible, but there's not always a 1:1 mapping between how insane works and how dompurify does. I'd like to get this change in early in the iteration to catch potential regressions * Remove logging and renaming param * Move dompurify to browser layer * Fixing tests and how we check valid attributes * Allow innerhtml in specific files * Use isEqualNode instead of checking innerHTML directly innerHTML can return different results on different browsers. Use `isEqualNode` instead * Reapply fix for trusted types * Enable ALLOW_UNKNOWN_PROTOCOLS I beleive this is required since we allow links to commands and loading images over remote * in -> of * Fix check of protocol * Enable two more safe tags 2021-09-03 21:17:02 +02:00			`<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types TrustedFunctionWorkaround ExtensionScripts amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget editorGhostText domLineBreaksComputer editorViewLayer diffReview extensionHostWorker dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString webNestedWorkerExtensionHost;">`
sandbox - allow to bring up a minimal workbench with simple services and in-memory file-system 2020-08-26 08:32:19 +02:00			`</head>`
			`<body aria-label="">`
			`</body>`

			`<!-- Init Bootstrap Helpers -->`
			`<script src="../../../../bootstrap.js"></script>`
			`<script src="../../../../vs/loader.js"></script>`
			`<script src="../../../../bootstrap-window.js"></script>`

			`<!-- Startup via workbench.js -->`
			`<script src="workbench.js"></script>`
			`</html>`