From 190fcab7ad560fe12c1c9346b0457f5320eba53b Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:27:25 +0000
Subject: [PATCH] Sandbox Web Page iframe and enforce http(s)/relative URL
 allowlist

Co-Authored-By: Jake Cosme <jake@cognition.ai>
---
 src/plugins/webPage/components/WebPage.vue | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/plugins/webPage/components/WebPage.vue b/src/plugins/webPage/components/WebPage.vue
index 5ce567a72a..15cf1f7cf9 100644
--- a/src/plugins/webPage/components/WebPage.vue
+++ b/src/plugins/webPage/components/WebPage.vue
@@ -21,13 +21,15 @@
 -->
 <template>
   <div class="l-iframe abs">
-    <iframe :src="url"></iframe>
+    <iframe :src="url" sandbox="allow-scripts allow-forms" referrerpolicy="no-referrer"></iframe>
   </div>
 </template>
 
 <script>
 import { sanitizeUrl } from '@braintree/sanitize-url';
 
+const BLOCKED_URL = 'about:blank';
+
 export default {
   inject: ['openmct', 'domainObject'],
   data: function () {
@@ -37,7 +39,18 @@ export default {
   },
   computed: {
     url() {
-      return sanitizeUrl(this.currentDomainObject.url);
+      const url = sanitizeUrl(this.currentDomainObject.url);
+
+      // Only allow http/https absolute urls and same-origin relative urls
+      const isSafeAbsoluteUrl = /^https?:\/\//i.test(url);
+      const isSafeRelativeUrl = /^\/(?!\/)/.test(url);
+      if (!isSafeAbsoluteUrl && !isSafeRelativeUrl) {
+        console.warn('Blocked unsafe URL:', url);
+
+        return BLOCKED_URL;
+      }
+
+      return url;
     }
   }
 };