fix(visualization): 隔离应用嵌入代码执行环境

core/core-frontend/src/custom-component/de-frame/ComponentAppFrame.vue

@@ -5,6 +5,7 @@
         v-if="state.frameShow"
         :id="'app-iframe-' + element.id"
         :srcdoc="srcDoc"
+        sandbox="allow-scripts"
         scrolling="auto"
         frameborder="0"
         class="main-frame main-de-iframe"
@@ -69,7 +70,7 @@ const buildBody = (src: string) => {
   return `<script>${src}<\/script>`
 }
 
-// 每个嵌入应用渲染在独立的 srcdoc iframe 中：相互隔离，删除组件即彻底销毁
+// sandbox 仅允许脚本在不透明源中运行，不可添加 allow-same-origin，否则可访问宿主页面和存储
 const srcDoc = computed(() => {
   const src = element.value?.frameLinks?.src || ''
   return `<!DOCTYPE html><html><head><meta charset="utf-8"><style>html,body{margin:0;padding:0;height:100%;width:100%;overflow:auto;}.copilot{height:100%;width:100%;}</style></head><body><div class="copilot"></div>${buildBody(

core/core-frontend/src/custom-component/de-frame/FrameLinks.vue

@@ -21,6 +21,7 @@
           v-model="state.linkInfoTemp.src"
           @blur="onAppBlur"
         />
+        <div class="app-embed-tips">{{ t('visualization.app_embed_sandbox_tips') }}</div>
       </el-form-item>
       <el-form-item v-else>
         <template #label>
@@ -123,6 +124,14 @@ watch(
 </script>
 
 <style lang="less" scoped>
+.app-embed-tips {
+  margin-top: 8px;
+  font-size: 12px;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+  color: var(--el-text-color-secondary);
+}
+
 .slot-class {
   color: white;
 }

core/core-frontend/src/locales/en.ts

@@ -3819,6 +3819,8 @@ export default {
     web_url: 'Web URL',
     app_embed: 'Embed Mode',
     app_embed_code: 'Embed Code',
+    app_embed_sandbox_tips:
+      'Embedded code runs in an isolated environment without access to the host page or its browser storage. Popups, form submissions and top-level navigation are blocked. Apps relying on these capabilities need adaptation, and external APIs must support cross-origin requests.',
     video_add_tips: 'Please configure video information...',
     link_add_tips_pre: 'Please configure web information..',
     web_add_tips_suf: 'Add web information...',

core/core-frontend/src/locales/tw.ts

@@ -3705,6 +3705,8 @@ export default {
     web_url: '網頁地址',
     app_embed: '嵌入模式',
     app_embed_code: '嵌入代碼',
+    app_embed_sandbox_tips:
+      '嵌入代碼在隔離環境中執行，無法存取宿主頁面或其瀏覽器儲存空間，不支援彈出視窗、表單提交和頂層頁面跳轉。依賴這些能力的應用需要調整，外部介面需支援跨來源存取。',
     video_add_tips: '請配置視頻信息...',
     link_add_tips_pre: '請配置網頁信息..',
     web_add_tips_suf: '添加網頁信息...',

core/core-frontend/src/locales/zh-CN.ts

@@ -3724,6 +3724,8 @@ export default {
     web_url: '网页地址',
     app_embed: '嵌入模式',
     app_embed_code: '嵌入代码',
+    app_embed_sandbox_tips:
+      '嵌入代码在隔离环境中运行，无法访问宿主页面或其浏览器存储，不支持弹窗、表单提交和顶层页面跳转。依赖这些能力的应用需要适配，外部接口需支持跨域访问。',
     video_add_tips: '请配置视频信息...',
     link_add_tips_pre: '请配置网页信息..',
     web_add_tips_suf: '添加网页信息...',