You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Handle iframe resizing and add a proxy service for custom builds of runestone running in an interactive's iframe.
This pull request introduces a new allowlisted experiment API tunnel to the book server and adds support for automatic iframe resizing for experimental Runestone components. It also includes comprehensive tests for the new API tunnel.
Experiment API Tunnel
Added an allowlisted experiment API tunnel endpoint (/experiments/{service}/{path}) to rsproxy.py, with strict SSRF protections, response size limits, timeout handling, and error mapping. Only explicitly named APIs (currently rdaas/api/duck) are accessible, and responses are capped in size and not cached. [1][2][3]
Added tests to verify correct behavior of the experiment API tunnel, including allowlist enforcement, error relaying, redirect refusal, response size capping, and timeout handling.
Frontend: Iframe Resize Support
Added pretext-iframe-resize.js, a script that enables experimental Runestone components in iframes to automatically request resizing from the parent PreTeXt page when their content changes.
Registered the new resize script in the main interactive webpack entry (webpack.index.js) so it is loaded with other common JS assets.
Adds support for custom Runestone components embedded in PreTeXt iframes, including automatic resizing and a book-server tunnel to an allowlisted experiment API.
Changes:
Adds an experiment API endpoint with redirect refusal, response-size limits, and timeout/error handling.
Reports iframe content-height changes to the parent page.
Adds proxy tests for allowlist enforcement, credential omission, and upstream failure handling.
Added a strip_cookies function to remove cookies from requests before sending them to the experiment API.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Using the iframe's own origin as targetOrigin prevents resizing when a custom build is hosted on a different origin from the book page: the browser checks this against the receiving parent, so every height report is discarded. PreTeXt's lti_iframe_resizer.js already supports cross-origin senders through contentWindow matching. Send to a configured parent origin, or use "*" for this non-sensitive, height-only message.
Test the streaming size limit without Content-Length
This mock uses content=, so HTTPX supplies Content-Length and the endpoint returns before exercising the streaming size limit. The test would still pass if that limit were removed, leaving chunked responses without a declared length unprotected against that regression. Keep the declared-length case and add an httpx.AsyncByteStream response whose chunks individually fit but together exceed the limit.
Although it creates risks if a researcher is using some API they don't control, I think we don't want to restrict what an experiment author can do with retrieved content. What do you think @bnmnetp ?
I think we need to trust the experimenter the same way we trust an author. Usually there are almost one and the same. Or certainly working closely together.
If there is a plausible scenario where this can be used to attack, then we should pay attention.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Handle iframe resizing and add a proxy service for custom builds of runestone running in an interactive's iframe.
This pull request introduces a new allowlisted experiment API tunnel to the book server and adds support for automatic iframe resizing for experimental Runestone components. It also includes comprehensive tests for the new API tunnel.
Experiment API Tunnel
/experiments/{service}/{path}) torsproxy.py, with strict SSRF protections, response size limits, timeout handling, and error mapping. Only explicitly named APIs (currentlyrdaas/api/duck) are accessible, and responses are capped in size and not cached. [1] [2] [3]Frontend: Iframe Resize Support
pretext-iframe-resize.js, a script that enables experimental Runestone components in iframes to automatically request resizing from the parent PreTeXt page when their content changes.webpack.index.js) so it is loaded with other common JS assets.