From e23f5ed5f95e0ecb84cb471f12e273ba5c646515 Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Sat, 13 Jun 2026 02:14:51 -0700
Subject: [PATCH 1/2] fix: replace iframe with link in build_inspect_data

cppreference.com sets X-Frame-Options: DENY (MediaWiki default), which
causes every browser to block the <iframe> used in build_inspect_data.
Replace it with a plain <a> anchor that opens the documentation URL in
a new tab, keeping the existing text/plain field intact.

Adds a unit test asserting the output contains an <a href> and no
<iframe>.

Fixes #484
---
 src/xinspect.cpp          | 23 ++++++-----------------
 test/test_interpreter.cpp | 13 +++++++++++++
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/src/xinspect.cpp b/src/xinspect.cpp
index 1ec45717..7583f0b6 100644
--- a/src/xinspect.cpp
+++ b/src/xinspect.cpp
@@ -198,23 +198,12 @@ namespace xcpp
     nl::json build_inspect_data(const std::string& inspect_result)
     {
         // Format html content.
-        std::string html_content = R"(<style>
-        #pager-container {
-            padding: 0;
-            margin: 0;
-            width: 100%;
-            height: 100%;
-        }
-        .xcpp-iframe-pager {
-            padding: 0;
-            margin: 0;
-            width: 100%;
-            height: 100%;
-            border: none;
-        }
-        </style>
-        <iframe class="xcpp-iframe-pager" src=")"
-                                   + inspect_result + R"(?action=purge"></iframe>)";
+        // Note: cppreference.com sets X-Frame-Options: DENY, so an <iframe> is
+        // blocked by every browser.  Use a plain link that opens in a new tab
+        // instead.
+        std::string html_content = R"(<a href=")" + inspect_result
+                                   + R"(" target="_blank" rel="noopener noreferrer">)"
+                                   + inspect_result + R"(</a>)";
 
         auto data = nl::json::object({{"text/plain", inspect_result}, {"text/html", html_content}});
         return data;
diff --git a/test/test_interpreter.cpp b/test/test_interpreter.cpp
index a1a11f57..159a8e01 100644
--- a/test/test_interpreter.cpp
+++ b/test/test_interpreter.cpp
@@ -1014,6 +1014,19 @@ TEST_SUITE("xinspect"){
         cmp.child_value = "nonexistentMethod";
         REQUIRE(cmp(node) == false);
     }
+
+    TEST_CASE("build_inspect_data_link_not_iframe"){
+        // cppreference.com sets X-Frame-Options: DENY, so the output must use
+        // an <a> link instead of an <iframe>.
+        std::string url = "https://en.cppreference.com/w/cpp/container/vector";
+        nl::json data = xcpp::build_inspect_data(url);
+
+        REQUIRE(data.contains("text/html"));
+        std::string html = data["text/html"].get<std::string>();
+        REQUIRE(html.find("<iframe") == std::string::npos);
+        REQUIRE(html.find(url) != std::string::npos);
+        REQUIRE(html.find("<a href=") != std::string::npos);
+    }
 }
 
 #if !defined(__EMSCRIPTEN__)

From 12538877c58c28555fdf3e5abd0cb3b20c8cb48a Mon Sep 17 00:00:00 2001
From: Matt Van Horn <mvanhorn@gmail.com>
Date: Thu, 27 Aug 2026 23:45:22 -0700
Subject: [PATCH 2/2] Render cppreference docs inline again via the MediaWiki
 API

cppreference.com sends X-Frame-Options: DENY, so pointing an iframe at
the page directly is blocked. Rather than degrade to a bare link, fetch
the page content through cppreference's own MediaWiki API and render it
inside a srcdoc iframe, so documentation appears below the cell again.

The iframe is sandboxed with allow-scripts but deliberately without
allow-same-origin, so the injected documentation runs at an opaque origin
and cannot reach the notebook. That is also why the API call passes
origin=*, MediaWiki's anonymous CORS mode.

Relative links and images are rewritten against the documentation URL,
anchors get target=_blank rel=noopener noreferrer, and every interpolated
URL is HTML-escaped. A failed fetch falls back to the plain link rather
than an empty frame. Non-cppreference URLs keep the direct src path.
---
 src/xinspect.cpp          | 132 ++++++++++++++++++++++++++++++++++++--
 test/test_interpreter.cpp |  24 +++++--
 2 files changed, 144 insertions(+), 12 deletions(-)

diff --git a/src/xinspect.cpp b/src/xinspect.cpp
index 7583f0b6..d77c9793 100644
--- a/src/xinspect.cpp
+++ b/src/xinspect.cpp
@@ -103,6 +103,109 @@ namespace xcpp
             }
             return result;
         }
+
+        std::string escape_html_attribute(const std::string& value)
+        {
+            std::string result;
+            result.reserve(value.size());
+            for (char c : value)
+            {
+                switch (c)
+                {
+                    case '&':
+                        result += "&amp;";
+                        break;
+                    case '"':
+                        result += "&quot;";
+                        break;
+                    case '\'':
+                        result += "&#39;";
+                        break;
+                    case '<':
+                        result += "&lt;";
+                        break;
+                    case '>':
+                        result += "&gt;";
+                        break;
+                    default:
+                        result += c;
+                }
+            }
+            return result;
+        }
+
+        std::string build_cppreference_srcdoc(const std::string& inspect_result)
+        {
+            return R"(<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<base href=")" + escape_html_attribute(inspect_result)
+                   + R"(" target="_blank">
+<style>
+body { margin: 0; font-family: system-ui, sans-serif; }
+.xcpp-status { padding: 1rem; }
+main { overflow: auto; }
+img { max-width: 100%; }
+pre { overflow: auto; }
+table { border-collapse: collapse; }
+th, td { border: 1px solid #aaa; padding: .25rem .5rem; }
+</style>
+</head>
+<body data-documentation-url=")"
+                   + escape_html_attribute(inspect_result) + R"(">
+<p class="xcpp-status">Loading documentation… <a href=")"
+                   + escape_html_attribute(inspect_result) + R"(">Open cppreference</a></p>
+<main></main>
+<script>
+const documentationUrl = document.body.dataset.documentationUrl;
+const status = document.querySelector('.xcpp-status');
+const content = document.querySelector('main');
+const pageUrl = new URL(documentationUrl);
+const page = pageUrl.pathname.replace(/^\/w\//, '').replace(/^\//, '');
+const apiUrl = new URL('/mwiki/api.php', pageUrl);
+apiUrl.search = new URLSearchParams({
+    action: 'parse',
+    page,
+    prop: 'text',
+    format: 'json',
+    formatversion: '2',
+    origin: '*'
+});
+
+fetch(apiUrl)
+    .then((response) => {
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}`);
+        }
+        return response.json();
+    })
+    .then((data) => {
+        if (!data.parse || !data.parse.text) {
+            throw new Error('Documentation was not returned');
+        }
+        content.innerHTML = data.parse.text;
+        content.querySelectorAll('[href], [src]').forEach((element) => {
+            ['href', 'src'].forEach((attribute) => {
+                const value = element.getAttribute(attribute);
+                if (value && !value.startsWith('#')) {
+                    element.setAttribute(attribute, new URL(value, documentationUrl).href);
+                }
+            });
+        });
+        content.querySelectorAll('a').forEach((link) => {
+            link.target = '_blank';
+            link.rel = 'noopener noreferrer';
+        });
+        status.remove();
+    })
+    .catch(() => {
+        status.firstChild.textContent = 'Unable to load documentation inline. ';
+    });
+</script>
+</body>
+</html>)";
+        }
     }
 
     std::string inspect(const std::string& code)
@@ -198,12 +301,29 @@ namespace xcpp
     nl::json build_inspect_data(const std::string& inspect_result)
     {
         // Format html content.
-        // Note: cppreference.com sets X-Frame-Options: DENY, so an <iframe> is
-        // blocked by every browser.  Use a plain link that opens in a new tab
-        // instead.
-        std::string html_content = R"(<a href=")" + inspect_result
-                                   + R"(" target="_blank" rel="noopener noreferrer">)"
-                                   + inspect_result + R"(</a>)";
+        std::string iframe_content;
+        if (inspect_result.rfind("https://en.cppreference.com/w/", 0) == 0)
+        {
+            iframe_content = R"(sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox" srcdoc=")"
+                             + escape_html_attribute(build_cppreference_srcdoc(inspect_result)) + R"(")";
+        }
+        else
+        {
+            iframe_content = R"(src=")" + escape_html_attribute(inspect_result) + R"(")";
+        }
+
+        std::string html_content = R"(<style>
+        .xcpp-iframe-pager {
+            padding: 0;
+            margin: 0;
+            width: 100%;
+            height: 100%;
+            min-height: 20rem;
+            border: none;
+        }
+        </style>
+        <iframe class="xcpp-iframe-pager" )"
+                                   + iframe_content + R"(></iframe>)";
 
         auto data = nl::json::object({{"text/plain", inspect_result}, {"text/html", html_content}});
         return data;
diff --git a/test/test_interpreter.cpp b/test/test_interpreter.cpp
index 159a8e01..f10097b4 100644
--- a/test/test_interpreter.cpp
+++ b/test/test_interpreter.cpp
@@ -1015,17 +1015,29 @@ TEST_SUITE("xinspect"){
         REQUIRE(cmp(node) == false);
     }
 
-    TEST_CASE("build_inspect_data_link_not_iframe"){
-        // cppreference.com sets X-Frame-Options: DENY, so the output must use
-        // an <a> link instead of an <iframe>.
+    TEST_CASE("build_inspect_data_embeds_cppreference_content"){
         std::string url = "https://en.cppreference.com/w/cpp/container/vector";
         nl::json data = xcpp::build_inspect_data(url);
 
         REQUIRE(data.contains("text/html"));
         std::string html = data["text/html"].get<std::string>();
-        REQUIRE(html.find("<iframe") == std::string::npos);
+        REQUIRE(html.find("<iframe") != std::string::npos);
+        REQUIRE(html.find("srcdoc=") != std::string::npos);
+        REQUIRE(html.find("/mwiki/api.php") != std::string::npos);
+        REQUIRE(html.find("origin") != std::string::npos);
         REQUIRE(html.find(url) != std::string::npos);
-        REQUIRE(html.find("<a href=") != std::string::npos);
+        REQUIRE(html.find("src=\"") == std::string::npos);
+    }
+
+    TEST_CASE("build_inspect_data_embeds_other_documentation_directly"){
+        std::string url = "https://docs.example.com/library/type";
+        nl::json data = xcpp::build_inspect_data(url);
+
+        REQUIRE(data.contains("text/html"));
+        std::string html = data["text/html"].get<std::string>();
+        REQUIRE(html.find("<iframe") != std::string::npos);
+        REQUIRE(html.find("src=\"" + url + "\"") != std::string::npos);
+        REQUIRE(html.find("srcdoc=") == std::string::npos);
     }
 }
 
@@ -1279,4 +1291,4 @@ TEST_CASE("Silent mode restores std::cout and std::cerr buffers")
     REQUIRE(std::cout.rdbuf() == cout_before);
     REQUIRE(std::cerr.rdbuf() == cerr_before);
 }
-#endif
\ No newline at end of file
+#endif