Skip to content

contract.md

Latest commit

 

History

History
72 lines (58 loc) · 3.12 KB

contract.md

File metadata and controls

72 lines (58 loc) · 3.12 KB
Raw

The OneUp HTML viewer authoring contract

Your HTML renders inside <iframe sandbox="allow-scripts"> under a strict Content-Security-Policy that fails silently — non-compliant HTML renders blank or partially broken with no error surfaced. Follow this contract and the page just works.

This is a snapshot for offline use. The authoritative, always-current version is generated from the live viewer source and served at https://<your-sharepoint-host>/_html/llms.txt. When they disagree, trust /_html/llms.txt.

Content-Security-Policy applied to your HTML

default-src 'none';
script-src 'unsafe-inline' 'unsafe-eval';
style-src 'unsafe-inline';
img-src data: blob:;
font-src data: blob:;
connect-src 'none';
worker-src 'none';
object-src 'none';
base-uri 'none';
form-action 'none';

The wrapper iframe additionally applies frame-src 'none'.

Non-negotiable rules

  1. No external resources — no <script src>, <link href>, <img src=https://…>, @import, url(https://…), remote fonts, or CDNs. Inline everything or use data: / blob: URIs.
  2. All script inline — <script> blocks only. No module imports, no import(), no <script src>.
  3. All styling inline — <style> or style="…". No <link rel="stylesheet">.
  4. No runtime network — fetch, XMLHttpRequest, WebSocket, sendBeacon, EventSource are blocked (connect-src 'none'). Use the LiveData manifest for SharePoint data.
  5. No storage primitives — localStorage, sessionStorage, indexedDB, document.cookie (opaque-origin sandbox). Set location.hash directly for cross-reload state — do not use history.pushState/replaceState, which always throws SecurityError here (the sandboxed document's base URL is inherited from the wrapper's blob: origin, so any url argument resolves to a mismatched origin).
  6. No top-level navigation, popups, form submission, workers, or plugins. alert / confirm / prompt are no-ops.
  7. Inline on*= handlers work (rewritten to nonced scripts) but are an XSS sink if they template untrusted data — prefer addEventListener for computed/user/fetched data.
  8. Save as UTF-8 (add a BOM when authoring by hand if non-ASCII renders wrong).

Links

<a href> opens only for same-tenant SharePoint hosts or the external allowlist. javascript: / vbscript: / data: hrefs are rejected.

Live SharePoint data (the only runtime data source)

Embed a manifest; the host prefetches each item server-side with the viewer's credentials and injects window.__LD_RESULTS__ (keyed by spItemUrl) before your script runs:

<script type="application/json" class="ka-livedata-manifest">
[{"spItemUrl":"https://contoso.sharepoint.com/…/_api/v2.0/drives/{driveId}/items/{itemId}"}]
</script>
  • Item cap: 32 per page.
  • Per-item size cap: 50 MB.
  • Supported formats: text, csv, xlsx-sheets.
  • Refresh: postMessage({type:'ka-html-viewer-refresh'}, '*') to the parent (debounced to 5s).

See ../assets/templates/livedata-dashboard.html for a working example.