AP-22412: Use replace to reload plot preview

to conform to allowed cross-origin script API access.

AP-22412 (Python View plot preview does not work)

org.knime.python3.scripting.nodes/js-src/src/components/PythonViewPreview.vue

@@ -4,13 +4,18 @@ import { usePythonPreviewStatusStore, useSessionStatusStore } from "@/store";
 import { onMounted, ref } from "vue";
 import Button from "webapps-common/ui/components/Button.vue";
 
+const IFRAME_SOURCE = "./preview.html";
+
 const iframe = ref<HTMLIFrameElement | null>(null);
 const pythonPreviewStatus = usePythonPreviewStatusStore();
 const sessionStatus = useSessionStatusStore();
 
 onMounted(() => {
   pythonPreviewStatus.updateViewCallback = () => {
-    iframe.value?.contentWindow?.location.reload();
+    // NB: This is a workaround to force the iframe to reload the content
+    // "replace" is allowed by the same-origin policy on the sandboxed iframe
+    // see https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#location
+    iframe.value?.contentWindow?.location.replace(IFRAME_SOURCE);
   };
 });
 </script>
@@ -22,7 +27,7 @@ onMounted(() => {
         ref="iframe"
         title="Preview"
         sandbox="allow-scripts"
-        src="./preview.html"
+        :src="IFRAME_SOURCE"
       />
     </div>
     <div

org.knime.python3.scripting.nodes/js-src/src/components/__tests__/PythonViewPreview.test.ts

@@ -32,11 +32,11 @@ describe("PythonViewPreview", () => {
     expect(previewStatusStore.updateViewCallback).toBeDefined();
   });
 
-  it("reloads iframe when update view callback is called", () => {
+  it("replaces iframe when update view callback is called", () => {
     // Mock the iframe's contentWindow
     const mockIframeContentWindow = {
       location: {
-        reload: vi.fn(),
+        replace: vi.fn(),
       },
     };
 
@@ -52,7 +52,7 @@ describe("PythonViewPreview", () => {
     const store = usePythonPreviewStatusStore();
     store.updateViewCallback!();
 
-    expect(mockIframeContentWindow.location.reload).toHaveBeenCalled();
+    expect(mockIframeContentWindow.location.replace).toHaveBeenCalled();
 
     delete store.updateViewCallback;
   });