Add Chrome extension with host/toolbar architecture for viewing Interactive Document files #52

Copilot · 2025-08-22T21:45:17Z

Add Chrome extension with host/toolbar architecture for viewing Interactive Document files
Implement automatic file detection for .idoc.md and .idoc.json files
Use secure sandbox infrastructure for iframe-based rendering
Integrate toolbar with "view source" and "download" functionality
Follow Chrome Manifest V3 standards
Reuse existing UMD bundles for consistency
Revert package-lock.json to original state and merge main
Regenerate package-lock.json after merging latest changes

The Chrome extension now follows the established host/toolbar architecture and has been properly synchronized with the latest main branch. The package-lock.json has been regenerated to reflect the current dependency state after merging main.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

packages/chrome-extension/src/content.ts

…ntation Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

danmarshall · 2025-08-22T23:22:25Z

@copilot nice job. Now see that we should use the host/toolbar model that we do in web/frontend and vscode. lets make sure to have all mesasge types in the common project. perhaps you can even resuse some of those instead of creating new ones. the toolbar should enable 'view source', and 'download'

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

packages/chrome-extension/src/content.ts

+      errorDiv.innerHTML = `
+        <h3>Error Loading Viewer</h3>
+        <p>${error.message}</p>
+        <button onclick="this.parentElement.remove()">Close</button>
+      `;


To fix this vulnerability, the exception message (error.message) must be HTML-escaped before being inserted into a template string and assigned to innerHTML. This prevents malicious input from being interpreted as markup or script. A simple HTML-escaping function must be added (e.g., converting <, >, &, ", and ' to their respective HTML entities). The fix should be inserted in the same file, with the escaping function defined locally or imported if appropriate (preferably local, as we're restricted to code within the shown file). Replace the direct reference to ${error.message} on line 236 with the escaped version via escapeHtml(error.message).

Required changes:

Add a utility function, e.g., escapeHtml(str: string): string near the top of the file.

During error display (line 236), replace interpolation of error.message with escapeHtml(error.message).

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

Copilot · 2025-08-22T23:33:28Z

@copilot nice job. Now see that we should use the host/toolbar model that we do in web/frontend and vscode. lets make sure to have all mesasge types in the common project. perhaps you can even resuse ...

I've refactored the Chrome extension to use the host/toolbar model as requested. The changes include:

Replaced custom overlay with Chartifact.host.Listener and Chartifact.toolbar.Toolbar
Reused existing UMD bundles (host, sandbox, compiler) for consistency
Configured toolbar with "view source" and "download" buttons (tweakButton and downloadButton)
Uses the same architecture patterns as web-frontend and vscode

The toolbar now properly supports viewing source code and downloading files as requested. The implementation follows the established host/toolbar model throughout the codebase.

Commit: 52a0fdd

danmarshall · 2025-09-03T17:34:42Z

@copilot can you undo your package-lock, merge main, and then regenerate it?

…opilot/fix-2a1a315d-3920-477b-ae2a-6148752c1e85 # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

Copilot · 2025-09-03T17:43:56Z

@copilot can you undo your package-lock, merge main, and then regenerate it?

Done! I've reverted the package-lock.json changes, merged main, and regenerated the package-lock.json. The changes are now properly synchronized with the latest main branch.

Commit: bd65bd6

Initial plan

5760c82

Copilot AI assigned Copilot and danmarshall Aug 22, 2025

Copilot started work on behalf of danmarshall August 22, 2025 21:45 View session

Add Chrome extension for viewing Interactive Documents

17b37fd

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

github-advanced-security bot found potential problems Aug 22, 2025

View reviewed changes

packages/chrome-extension/src/content.ts Fixed Show fixed Hide fixed

Complete Chrome extension with improved icons, test files, and docume…

783dd94

…ntation Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

Copilot AI changed the title ~~Chrome Extension~~ Add Chrome extension for viewing Interactive Document files Aug 22, 2025

Copilot AI requested a review from danmarshall August 22, 2025 22:01

Copilot finished work on behalf of danmarshall August 22, 2025 22:01

Copilot started work on behalf of danmarshall August 22, 2025 23:22 View session

Refactor Chrome extension to use host/toolbar architecture

6276024

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

github-advanced-security bot found potential problems Aug 22, 2025

View reviewed changes

Complete Chrome extension refactoring with host/toolbar architecture

52a0fdd

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

Copilot AI changed the title ~~Add Chrome extension for viewing Interactive Document files~~ Add Chrome extension with host/toolbar architecture for viewing Interactive Document files Aug 22, 2025

Copilot finished work on behalf of danmarshall August 22, 2025 23:34

danmarshall marked this pull request as ready for review September 3, 2025 17:33

Copilot started work on behalf of danmarshall September 3, 2025 17:34 View session

Copilot AI and others added 3 commits September 3, 2025 17:38

Revert package-lock.json to original state before merging main

7c0ab4c

Regenerate package-lock.json after merging main

bd65bd6

Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>

Copilot finished work on behalf of danmarshall September 3, 2025 17:45

@@ -3,6 +3,16 @@
              * Licensed under the MIT License.
              */
+            // Utility to escape HTML for safe insertion into innerHTML
+            function escapeHtml(str: string): string {
+              return str
+                .replace(/&/g, '&amp;')
+               .replace(/</g, '&lt;')
+               .replace(/>/g, '&gt;')
+               .replace(/"/g, '&quot;')
+               .replace(/'/g, '&#39;');
+            }
             // Content script that runs on pages with .idoc files
             (function() {
               'use strict';
@@ -233,7 +243,7 @@
                   `;
                   errorDiv.innerHTML = `
                     <h3>Error Loading Viewer</h3>
-                    <p>${error.message}</p>
+                    <p>${escapeHtml(error.message)}</p>
                     <button onclick="this.parentElement.remove()">Close</button>
                   `;
                   document.body.appendChild(errorDiv);

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Chrome extension with host/toolbar architecture for viewing Interactive Document files #52

Add Chrome extension with host/toolbar architecture for viewing Interactive Document files #52

Uh oh!

Copilot AI commented Aug 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

danmarshall commented Aug 22, 2025

Uh oh!

Check warning

Copilot Autofix

Copilot AI commented Aug 22, 2025

Uh oh!

danmarshall commented Sep 3, 2025

Uh oh!

Copilot AI commented Sep 3, 2025

Uh oh!

Uh oh!

Add Chrome extension with host/toolbar architecture for viewing Interactive Document files #52

Are you sure you want to change the base?

Add Chrome extension with host/toolbar architecture for viewing Interactive Document files #52

Uh oh!

Conversation

Copilot AI commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

danmarshall commented Aug 22, 2025

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Copilot AI commented Aug 22, 2025

Uh oh!

danmarshall commented Sep 3, 2025

Uh oh!

Copilot AI commented Sep 3, 2025

Uh oh!

Uh oh!

Copilot AI commented Aug 22, 2025 •

edited

Loading