Support CryptPad

[lsd-cat]

Blocked on #3

We could try without the sandbox, but I am conceptually against disabling a complementary security feature (domain sandboxing) for our one.

[lsd-cat]

#31 adds support for sandboxing, however while testing, I found a number of other compatibility shortcomings with Cryptpad:

• The CSP is not the same on every page/asset
• There are some script-src and frame-src origins that needs to be disabled (like resource:)
• They load scripts cross-origin (the PR proposed allows it, but it's not granted it will be in the final design)
• Config is loaded as a script dynamically generated from /api/config

[lsd-cat]

Other exceptions include /api/instance also loaded dynamically as a script. Also there's a script that gets loaded from /extensions.js/, yes with a trailing slash.

[lsd-cat]

Oki, forcing the following files:

• /api/config=7c7825bbb497e77b8dd4619d036a583320951c2d38275c38a334ed4bf44a7696
• /api/instance=388cbe353ff9353f59a8250b940de81b4b9fefc8da4ce8335d0aedaeaf7e6a48
• /extensions.js=aa806b924a9cb090e7cd47e2cf7c6d93c85804073d289c201a44635b03c7a65e
• /customize.dist/login.js=157f0f6fcbcccdac2d0709120719d8e59e766bf3c4c6c9e655f5fe0bca6d3440
• /api/broadcast=fefcb386310b7dfbd65849b0d78681862004dce1366c6f33a83cd86cc1473873

They are static per instance, just not served from the same path statically and dynamically. With these the interface loads but it still has some CSP failures, apparently despite having the same source, the sandbox domain and the main domain load stylesheets cross origin from each other.

[lsd-cat]

Got it, I had to edit require.js to always load from the same origin. Will post a guide soon

[lsd-cat]

Guide here \0/