Merge pull request #154933 from microsoft/joh/preferred-gibbon

joh/preferred gibbon

3 files changed, 31 insertions, 8 deletions

diff --git a/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html b/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
index ec2b7281a65..6469cf31e74 100644
--- a/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
+++ b/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
@@ -919,14 +919,21 @@
 					sandboxRules.add('allow-forms');
 				}
 				newFrame.setAttribute('sandbox', Array.from(sandboxRules).join(' '));
-				if (!isFirefox) {
-					newFrame.setAttribute('allow', options.allowScripts ? 'clipboard-read; clipboard-write;' : '');
+
+				const allowRules = ['cross-origin-isolated;']
+				if(!isFirefox && options.allowScripts) {
+					allowRules.push('clipboard-read;','clipboard-write;')
 				}
+				newFrame.setAttribute('allow', allowRules.join(' '));
 				// We should just be able to use srcdoc, but I wasn't
 				// seeing the service worker applying properly.
 				// Fake load an empty on the correct origin and then write real html
 				// into it to get around this.
-				newFrame.src = `./fake.html?id=${ID}`;
+				const fakeUrlParams = new URLSearchParams({id: ID});
+				if(globalThis.crossOriginIsolated) {
+					fakeUrlParams.set('vscode-coi', '3') /*COOP+COEP*/
+				}
+				newFrame.src = `./fake.html?${fakeUrlParams.toString()}`;
 
 				newFrame.style.cssText = 'display: block; margin: 0; overflow: hidden; position: absolute; width: 100%; height: 100%; visibility: hidden';
 				document.body.appendChild(newFrame);
diff --git a/src/vs/workbench/contrib/webview/browser/pre/index.html b/src/vs/workbench/contrib/webview/browser/pre/index.html
index 326a076c677..965b90ace22 100644
--- a/src/vs/workbench/contrib/webview/browser/pre/index.html
+++ b/src/vs/workbench/contrib/webview/browser/pre/index.html
@@ -5,7 +5,7 @@
 	<meta charset="UTF-8">
 
 	<meta http-equiv="Content-Security-Policy"
-		content="default-src 'none'; script-src 'sha256-v9xEHcwDE5dc/lU7HYs5bG3LpPWGmQe0w/Vz6kmdd60=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+		content="default-src 'none'; script-src 'sha256-vGloSX/Mg/JYMjFOA5bYxbKTao1iYLW/tlq9ME/cEOo=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
 	<!-- Disable pinch zooming -->
 	<meta name="viewport"
@@ -920,14 +920,21 @@
 					sandboxRules.add('allow-forms');
 				}
 				newFrame.setAttribute('sandbox', Array.from(sandboxRules).join(' '));
-				if (!isFirefox) {
-					newFrame.setAttribute('allow', options.allowScripts ? 'clipboard-read; clipboard-write;' : '');
+
+				const allowRules = ['cross-origin-isolated;']
+				if(!isFirefox && options.allowScripts) {
+					allowRules.push('clipboard-read;','clipboard-write;')
 				}
+				newFrame.setAttribute('allow', allowRules.join(' '));
 				// We should just be able to use srcdoc, but I wasn't
 				// seeing the service worker applying properly.
 				// Fake load an empty on the correct origin and then write real html
 				// into it to get around this.
-				newFrame.src = `./fake.html?id=${ID}`;
+				const fakeUrlParams = new URLSearchParams({id: ID});
+				if(globalThis.crossOriginIsolated) {
+					fakeUrlParams.set('vscode-coi', '3') /*COOP+COEP*/
+				}
+				newFrame.src = `./fake.html?${fakeUrlParams.toString()}`;
 
 				newFrame.style.cssText = 'display: block; margin: 0; overflow: hidden; position: absolute; width: 100%; height: 100%; visibility: hidden';
 				document.body.appendChild(newFrame);
diff --git a/src/vs/workbench/contrib/webview/browser/webviewElement.ts b/src/vs/workbench/contrib/webview/browser/webviewElement.ts
index 77aaf6683f9..fcc0777e76a 100644
--- a/src/vs/workbench/contrib/webview/browser/webviewElement.ts
+++ b/src/vs/workbench/contrib/webview/browser/webviewElement.ts
@@ -474,9 +474,14 @@ export class WebviewElement extends Disposable implements IWebview, WebviewFindD
 		element.name = this.id;
 		element.className = `webview ${options.customClasses || ''}`;
 		element.sandbox.add('allow-scripts', 'allow-same-origin', 'allow-forms', 'allow-pointer-lock', 'allow-downloads');
+
+		const allowRules = ['cross-origin-isolated;'];
 		if (!isFirefox) {
-			element.setAttribute('allow', 'clipboard-read; clipboard-write;');
+			allowRules.push('clipboard-read;', 'clipboard-write;');
+			element.setAttribute('allow', 'clipboard-read; clipboard-write; cross-origin-isolated;');
 		}
+		element.setAttribute('allow', allowRules.join(' '));
+
 		element.style.border = 'none';
 		element.style.width = '100%';
 		element.style.height = '100%';
@@ -508,6 +513,10 @@ export class WebviewElement extends Disposable implements IWebview, WebviewFindD
 			params.purpose = options.purpose;
 		}
 
+		if (globalThis.crossOriginIsolated) {
+			params['vscode-coi'] = '3'; /*COOP+COEP*/
+		}
+
 		const queryString = new URLSearchParams(params).toString();
 
 		// Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1754872