Intercept iframe popup attempts and redirect to main iframe

[Copilot]

Proxied sites attempting to open popups via window.open() now load in the main iframe instead of opening new tabs/windows, while preserving Ultraviolet's allow-popups requirement.

Implementation

• Sandbox attributes - Added to iframe with allow-popups but excluded allow-popups-to-escape-sandbox
• Popup interceptor - New /public/popup-interceptor.js overrides window.open(), intercepts calls with _blank/_new/empty targets, sends URL to parent via postMessage
• Service worker injection - Modified /public/sw.js to inject interceptor script into all proxied HTML responses

Example

// In proxied page context
window.open('https://example.com', '_blank');
// → Intercepted, sends postMessage to parent
// → Parent loads https://example.com in main iframe instead

Screenshots

Interceptor successfully initialized in proxied content:

Console confirms: [Radius] Popup interceptor initialized

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: node /home/REDACTED/work/Radius/Radius/node_modules/.bin/astro dev (dns block)
• telemetry.astro.build
  • Triggering command: node /home/REDACTED/work/Radius/Radius/node_modules/.bin/astro build (dns block)
  • Triggering command: node /home/REDACTED/work/Radius/Radius/node_modules/.bin/astro dev (dns block)
  • Triggering command: node /home/REDACTED/work/Radius/Radius/node_modules/.bin/astro dev --host 0.0.0.0 (dns block)
• www.google.com
  • Triggering command: node /home/REDACTED/work/Radius/Radius/node_modules/.bin/astro dev (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

add a simple system that chaches new request trying to escape the iframe and open a new tab (keep the alow popups sandbox atrabute so ultravilot can still work) and then make it so the request open the sites iframe instead of a new tab/window.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

• Start Development Server
• Start Production Server