diff --git a/dash-renderer/src/AccessDenied.react.js b/dash-renderer/src/AccessDenied.react.js index 6dd7ab2808..ab93ab006d 100644 --- a/dash-renderer/src/AccessDenied.react.js +++ b/dash-renderer/src/AccessDenied.react.js @@ -28,9 +28,12 @@ function AccessDenied(props) { { - document.cookie = - `${constants.OAUTH_COOKIE_NAME}=; ` + - 'expires=Thu, 01 Jan 1970 00:00:01 GMT;'; + /* eslint no-empty: ["error", { "allowEmptyCatch": true }] */ + try { + document.cookie = + `${constants.OAUTH_COOKIE_NAME}=; ` + + 'expires=Thu, 01 Jan 1970 00:00:01 GMT;'; + } catch (e) {} window.location.reload(true); }} > diff --git a/dash-renderer/src/actions/index.js b/dash-renderer/src/actions/index.js index c6c9b6c772..c61aaecce6 100644 --- a/dash-renderer/src/actions/index.js +++ b/dash-renderer/src/actions/index.js @@ -55,9 +55,13 @@ export function hydrateInitialOutputs() { } export function getCSRFHeader() { - return { - 'X-CSRFToken': cookie.parse(document.cookie)._csrf_token, - }; + try { + return { + 'X-CSRFToken': cookie.parse(document.cookie)._csrf_token, + }; + } catch (e) { + return {}; + } } function triggerDefaultState(dispatch, getState) { diff --git a/tests/integration/renderer/test_iframe.py b/tests/integration/renderer/test_iframe.py new file mode 100644 index 0000000000..ac52f17164 --- /dev/null +++ b/tests/integration/renderer/test_iframe.py @@ -0,0 +1,51 @@ +from multiprocessing import Value + +import dash +from dash.dependencies import Input, Output +from dash.exceptions import PreventUpdate + +import dash_html_components as html + + +def test_rdif001_sandbox_allow_scripts(dash_duo): + app = dash.Dash(__name__) + call_count = Value("i") + + N_OUTPUTS = 50 + + app.layout = html.Div([ + html.Button("click me", id="btn"), + ] + [html.Div(id="output-{}".format(i)) for i in range(N_OUTPUTS)]) + + @app.callback( + [Output("output-{}".format(i), "children") for i in range(N_OUTPUTS)], + [Input("btn", "n_clicks")] + ) + def update_output(n_clicks): + if n_clicks is None: + raise PreventUpdate + + call_count.value += 1 + return ["{}={}".format(i, i + n_clicks) for i in range(N_OUTPUTS)] + + @app.server.after_request + def apply_cors(response): + response.headers["Access-Control-Allow-Origin"] = "*" + response.headers["Access-Control-Allow-Headers"] = "Origin, X-Requested-With, Content-Type, Accept, Authorization" + return response + + dash_duo.start_server(app) + + iframe = """ + + + + + """ + + html_content = iframe.format(dash_duo.server_url) + + dash_duo.driver.get("data:text/html;charset=utf-8," + html_content) + + assert not dash_duo.get_logs()