Use allow-popups-to-escape-sandbox for preview sandbox

Otherwise the "popups" opened by clicking on links in preview are sandbox. This for example breaks youtube links on feeds such as: https://www.youtube.com/feeds/videos.xml?user=JustinTimberlake
nt1m · Feb 8, 2021 · 1bd0f69 · 1bd0f69
1 parent 6fdada5
commit 1bd0f69
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/pages/reader/reader.js b/pages/reader/reader.js
@@ -52,7 +52,6 @@ function getPreviewHTML({ items }) {
       anchor.href = item.url;
     }
     anchor.textContent = item.title;
-    anchor.target = "_blank";
     anchor.className = "item_title";
 
     const time = document.createElement("time");

diff --git a/pages/subscribe/subscribe.js b/pages/subscribe/subscribe.js
@@ -13,7 +13,7 @@ async function setPreviewContent(html) {
   frame.classList.add("grow");
   // DANGER! The next line is security critical for this extension!
   // Without this sandbox, malicious feeds can trivially exploit us.
-  frame.sandbox = "allow-popups";
+  frame.sandbox = "allow-popups allow-popups-to-escape-sandbox";
 
   const sheetUrl = chrome.extension.getURL("pages/reader/reader.css");
   const response = await fetch(sheetUrl);