Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions .github/workflows/single-file.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
name: Create single file build

on:
push:
branches: ["**"]
workflow_dispatch:

permissions:
contents: read

concurrency:
group: "single-file-build"
cancel-in-progress: false
Comment thread
NellowTCS marked this conversation as resolved.

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Use Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
cache: "npm"
cache-dependency-path: "Build/package-lock.json"

- name: Install dependencies
working-directory: Build
run: npm ci

- name: Build
working-directory: Build
run: npm run build:single

- name: Rename for distribution
working-directory: Build/dist
run: mv index.html HTMLRunner.html

- name: Upload Build Artifact
uses: actions/upload-artifact@v4
with:
name: HTMLRunner-Standalone
path: Build/dist/HTMLRunner.html
if-no-files-found: error
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
44 changes: 21 additions & 23 deletions .github/workflows/static.yml
Original file line number Diff line number Diff line change
@@ -1,45 +1,43 @@
# .github/workflows/static.yml
name: Deploy static content to Pages
# Simple workflow for deploying static content to GitHub Pages
name: Deploy browser build to GitHub Pages

on:
push:
branches: ["main"]
workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
contents: read
pages: write
id-token: write
contents: write

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
group: "pages"
cancel-in-progress: true
cancel-in-progress: false

jobs:
deploy:
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
runs-on: ubuntu-latest
steps:
- name: Checkout repository
- name: Checkout
uses: actions/checkout@v4

- name: Setup Node.js
- name: Use Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
node-version: "20"

- name: Run build script
run: |
chmod +x Build/Buildscripts/build.sh
./Build/Buildscripts/build.sh
- name: Install dependencies
working-directory: Build
run: npm i

- name: Upload GitHub Pages artifact
uses: actions/upload-pages-artifact@v3
with:
path: 'Build/dist'
- name: Build
working-directory: Build
run: npm run build

- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
- name: Deploy browser build to GitHub Pages
uses: peaceiris/actions-gh-pages@v4
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: Build/dist
16 changes: 0 additions & 16 deletions Build/Buildscripts/build-all.sh

This file was deleted.

67 changes: 0 additions & 67 deletions Build/Buildscripts/build-inline.sh

This file was deleted.

21 changes: 0 additions & 21 deletions Build/Buildscripts/build.sh

This file was deleted.

14 changes: 14 additions & 0 deletions Build/eslint.config.mts
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
import js from "@eslint/js";
import globals from "globals";
import tseslint from "typescript-eslint";
import json from "@eslint/json";
import markdown from "@eslint/markdown";
import css from "@eslint/css";
import { defineConfig } from "eslint/config";

export default defineConfig([
{ files: ["**/*.{js,mjs,cjs,ts,mts,cts}"], plugins: { js }, extends: ["js/recommended"], languageOptions: { globals: globals.browser } },
Comment thread
NellowTCS marked this conversation as resolved.
tseslint.configs.recommended,
{ files: ["**/*.md"], plugins: { markdown }, language: "markdown/gfm", extends: ["markdown/recommended"] },
{ files: ["**/*.css"], plugins: { css }, language: "css/css", extends: ["css/recommended"] },
]);
67 changes: 67 additions & 0 deletions Build/index.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>HTMLRunner</title>
<link rel="stylesheet" href="./styles/styles.css">
</head>
<body>
<div class="loading" id="loading">
<div class="spinner"></div>
</div>
<div class="error-message" id="error-message"></div>
<div class="container">
<div class="header">
<div class="logo">HTMLRunner</div>
<div class="controls">
<button class="btn btn-run"><i class="fas fa-play"></i> Run</button>
<button class="btn btn-format"><i class="fas fa-code"></i> Format</button>
<button class="btn btn-reset"><i class="fas fa-undo"></i> Reset</button>
<button class="btn btn-clear"><i class="fas fa-trash"></i> Clear Console</button>
<button class="btn btn-download"><i class="fas fa-download"></i> Export Code</button>
<button class="btn btn-auto-run"><i class="fas fa-sync"></i> Auto-Run: <span id="auto-run-status">Off</span></button>
<button class="theme-toggle">
<i class="fas fa-moon"></i>
<span>Dark Mode</span>
</button>
</div>
</div>
<div class="main">
<div class="editor-panel" id="editor-panel">
<div class="editor-header">
<div class="file-tabs" id="file-tabs"></div>
</div>
<div class="editor-body">
<div class="sidebar" id="sidebar">
<div class="sidebar-header">
<span>FILES</span>
<button class="sidebar-new-btn" id="sidebar-new-btn" title="New File"><i class="fas fa-plus"></i></button>
</div>
<div class="file-tree" id="file-tree"></div>
<div class="sidebar-section">
<div class="sidebar-header">
<span>GIT</span>
<button class="sidebar-git-btn" id="sidebar-git-btn" title="Commit"><i class="fas fa-check"></i></button>
</div>
<div class="git-status" id="git-status"></div>
</div>
</div>
<div class="editor-container" id="editor-container"></div>
</div>
</div>
<div class="output-panel" id="output-panel">
<div class="output-tabs">
<div class="tab active" data-output="preview">Preview</div>
<div class="tab" data-output="console">Console</div>
</div>
<div class="output-content">
<iframe id="preview" class="preview active"></iframe>
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Sandbox the preview iframe.

This runner executes user code inside #preview. Without a sandbox attribute, previewed scripts can reach the parent app and its storage through window.parent, which breaks isolation.

🔒 Minimal hardening
-                    <iframe id="preview" class="preview active"></iframe>
+                    <iframe id="preview" class="preview active" sandbox="allow-scripts"></iframe>
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Build/index.html` at line 59, The preview iframe (<iframe id="preview"
class="preview active">) lacks a sandbox attribute allowing previewed scripts to
access the parent; add a sandbox attribute to harden isolation (e.g.,
sandbox="allow-scripts" for running user scripts but preventing access to
window.parent/storage) on the iframe with id="preview" and avoid including
permissions like allow-same-origin or allow-top-navigation unless explicitly
required.

<div id="console" class="console"></div>
</div>
</div>
</div>
</div>
<script type="module" src="./src/main.ts"></script>
</body>
</html>
Loading
Loading