From 0a9f5a1da971504cfe9c7e9865cf82d49912366b Mon Sep 17 00:00:00 2001
From: donteatfriedrice <chs@bupt.cn>
Date: Wed, 7 May 2025 04:01:57 +0000
Subject: [PATCH] fix(editor): add credentialless attribute to iframe for COEP
 compliance (#12161)

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->

## Summary by CodeRabbit

- **New Features**
  - Added enhanced privacy controls by including the `credentialless` attribute to embedded content iframes for PDF, Figma, Loom, YouTube, and generic iframe blocks. This helps improve security and privacy when displaying embedded content.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 blocksuite/affine/blocks/attachment/src/embed.ts                 | 1 +
 .../blocks/embed/src/embed-figma-block/embed-figma-block.ts      | 1 +
 .../blocks/embed/src/embed-iframe-block/embed-iframe-block.ts    | 1 +
 .../affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts | 1 +
 .../blocks/embed/src/embed-youtube-block/embed-youtube-block.ts  | 1 +
 5 files changed, 5 insertions(+)

diff --git a/blocksuite/affine/blocks/attachment/src/embed.ts b/blocksuite/affine/blocks/attachment/src/embed.ts
index e9dc7a2f4..80729bec1 100644
--- a/blocksuite/affine/blocks/attachment/src/embed.ts
+++ b/blocksuite/affine/blocks/attachment/src/embed.ts
@@ -157,6 +157,7 @@ const embedConfig: AttachmentEmbedConfig[] = [
           allowTransparency
           allowfullscreen
           type="application/pdf"
+          credentialless
         ></iframe>
         <div class="affine-attachment-embed-event-mask"></div>
       `;
diff --git a/blocksuite/affine/blocks/embed/src/embed-figma-block/embed-figma-block.ts b/blocksuite/affine/blocks/embed/src/embed-figma-block/embed-figma-block.ts
index 596cc1cd1..48bffe132 100644
--- a/blocksuite/affine/blocks/embed/src/embed-figma-block/embed-figma-block.ts
+++ b/blocksuite/affine/blocks/embed/src/embed-figma-block/embed-figma-block.ts
@@ -89,6 +89,7 @@ export class EmbedFigmaBlockComponent extends EmbedBlockComponent<EmbedFigmaMode
                 src=${`https://www.figma.com/embed?embed_host=blocksuite&url=${url}`}
                 allowfullscreen
                 loading="lazy"
+                credentialless
               ></iframe>
 
               <!-- overlay to prevent the iframe from capturing pointer events -->
diff --git a/blocksuite/affine/blocks/embed/src/embed-iframe-block/embed-iframe-block.ts b/blocksuite/affine/blocks/embed/src/embed-iframe-block/embed-iframe-block.ts
index 80b736fb6..cd7341f40 100644
--- a/blocksuite/affine/blocks/embed/src/embed-iframe-block/embed-iframe-block.ts
+++ b/blocksuite/affine/blocks/embed/src/embed-iframe-block/embed-iframe-block.ts
@@ -311,6 +311,7 @@ export class EmbedIframeBlockComponent extends CaptionedBlockComponent<EmbedIfra
         ?allowfullscreen=${allowFullscreen}
         loading="lazy"
         frameborder="0"
+        credentialless
         src=${ifDefined(iframeUrl)}
         allow=${ifDefined(allow)}
         referrerpolicy=${ifDefined(referrerpolicy)}
diff --git a/blocksuite/affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts b/blocksuite/affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts
index f8de5ba5a..47667de64 100644
--- a/blocksuite/affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts
+++ b/blocksuite/affine/blocks/embed/src/embed-loom-block/embed-loom-block.ts
@@ -127,6 +127,7 @@ export class EmbedLoomBlockComponent extends EmbedBlockComponent<
                       frameborder="0"
                       allow="fullscreen; accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
                       loading="lazy"
+                      credentialless
                     ></iframe>
 
                     <!-- overlay to prevent the iframe from capturing pointer events -->
diff --git a/blocksuite/affine/blocks/embed/src/embed-youtube-block/embed-youtube-block.ts b/blocksuite/affine/blocks/embed/src/embed-youtube-block/embed-youtube-block.ts
index a4f057e2a..61315c18d 100644
--- a/blocksuite/affine/blocks/embed/src/embed-youtube-block/embed-youtube-block.ts
+++ b/blocksuite/affine/blocks/embed/src/embed-youtube-block/embed-youtube-block.ts
@@ -151,6 +151,7 @@ export class EmbedYoutubeBlockComponent extends EmbedBlockComponent<
                       allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
                       allowfullscreen
                       loading="lazy"
+                      credentialless
                     ></iframe>
 
                     <!-- overlay to prevent the iframe from capturing pointer events -->