fix(preview): don't crash the preview panel on a malformed iframe URL - #6362
Merged
Conversation
withDeviceHint and withDecoFBT (added in #6357) call `new URL(url, ...)` directly in the render path with no guard, unlike the adjacent previewOrigin helper which already treats a malformed URL as non-fatal. A bad directPreviewUrl/previewUrl (e.g. an unparseable IPv6 host from the sandbox daemon) throws mid-render and takes down the whole preview panel instead of just failing to apply the deviceHint/__decoFBT param. Wrap both in try/catch and fall back to the original url, matching previewOrigin's existing shape.
pedrofrxncx
added a commit
that referenced
this pull request
Aug 20, 2026
… URL (#6374) #6362 wrapped withDeviceHint/withDecoFBT's new URL() calls in try/catch after a malformed directPreviewUrl/previewUrl crashed the whole preview panel mid-render, matching previewOrigin's existing defensive shape. It missed four sibling call sites that construct URLs from the same untrusted display.iframeBase (sandbox daemon / production preview server config): productionOrigin, the two iframeSrc branches, and productionOpenTabBase. Each still calls new URL(...) unguarded as an argument expression, so a malformed iframeBase (e.g. an unparseable host) throws before withDeviceHint/withVariantMatcherOverride's own try/catch ever runs, taking the panel down the same way #6362 fixed for the other inputs. Added resolvePreviewUrl(), the same try/catch-and-fall-back-to-null shape as previewOrigin, and use it (or previewOrigin itself) at all four sites.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows #6357 (
withDecoFBT) hardening.withDeviceHintandwithDecoFBTinpreview.tsxcallnew URL(url, window.location.href)directly in the render path with no guard. Right next to them,previewOriginalready treats a malformed URL as non-fatal (try { ... } catch { return null }) — these two don't follow that pattern.Failure scenario: if
directPreviewUrl/previewUrl(sourced from the sandbox daemon / draft preview state) is ever an unparseable string — e.g.http://[::1(bad IPv6 literal) —new URL(...)throws synchronously during render, taking down the wholePreviewContenttree instead of just failing to apply thedeviceHint/__decoFBTquery param.Fix: wrap both in try/catch and fall back to returning the original
urlunmodified, matchingpreviewOrigin's existing shape in the same file.Regression test:
apps/web/src/components/sandbox/preview/preview.test.ts— exercises both helpers on a well-formed URL and on a URL that throws inside the WHATWG URL parser (http://[::1), asserting the malformed case returns the input unchanged instead of throwing.Reviewer check:
bun test apps/web/src/components/sandbox/preview/preview.test.tsLocally verified:
bun run fmt(no changes),cd apps/web && bunx tsc --noEmit(clean),bunx oxlinton both changed files (0 warnings/errors), targeted test above (5/5 pass). Full CI covers the rest.Summary by cubic
Prevents the preview panel from crashing on a malformed iframe URL by hardening
withDeviceHintandwithDecoFBT. Previouslynew URL(...)threw during render; now both helpers catch parse errors and return the original URL, so only the query param is skipped.previewUrl/directPreviewUrlno longer breaksPreviewContent;deviceHint/__decoFBTmay be omitted in that case. MatchespreviewOrigin’s defensive handling.apps/web/src/components/sandbox/preview/preview.tsx(try/catch wrappers). Tests inapps/web/src/components/sandbox/preview/preview.test.ts; runbun test apps/web/src/components/sandbox/preview/preview.test.ts.Written for commit 84895b0. Summary will update on new commits.