# A sandboxed GitHub raw JSONC document: tested viewer behavior

Tested 8 October 2026. On 8 October 2026, JSON All-in-One 1.0.9 opened and interactively displayed the tested GitHub raw keymap, a JSONC document served as text/plain with a sandbox CSP. The three named competitors remained raw with default settings on that exact URL. This is not evidence that all competing viewers fail on sandboxed JSON: JSON Formatter and JSONVue passed strict-JSON controls with the same CSP.

## Exact public response

[Tested GitHub raw keymap](https://raw.githubusercontent.com/dol/zed-netbeans-keymap/refs/heads/main/keymap.json) returned HTTP 200, `text/plain; charset=utf-8`, `X-Content-Type-Options: nosniff`, and:

`Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`

The decoded body was 3,007 bytes, SHA-256 `e750767becec59ff398a49e96f4509da9df417103ee3225c836196636eb5308e`. It contains // comments: the .json filename does not make it strict JSON. The URL tracks a branch and may change after this test.

## Observed results

Default settings; one qualified attempt per cell. “Tree + interaction” requires visible structured data and real mouse collapse/re-expand, with a known binding disappearing and reappearing. “Raw” means no extension tree within the observation bound, not a crash or proven injection block.

| CWS-delivered version | Live GitHub JSONC, sandbox CSP | Strict JSON text/plain, no CSP (local) | Same strict JSON + GitHub CSP (local) |
|---|---|---|---|
| JSON Formatter 0.10.2 | Raw / no tree | Tree + interaction | Tree + interaction |
| JSONVue 0.2.3 | Raw / no tree | Tree + interaction | Tree + interaction |
| JSON Viewer Pro 1.0.7 | Raw / no tree | Raw / no tree | Raw / no tree |
| JSON All-in-One 1.0.9 | Tree + interaction | Tree + interaction | Tree + interaction |

JSON Viewer Pro was also tested with the strict control served as application/json: **tree + interaction without CSP; raw with CSP**, with Chrome recording blocked script execution in the sandboxed frame. Its delivered default content-type allowlist excludes text/plain, which explains why the earlier text/plain controls did not exercise its viewer renderer. This additional pair establishes a policy-related failure for this version and fixture; it does not isolate sandbox from the other directives in the CSP bundle.

JSON Formatter also logged a sandbox/allow-scripts block in its **successful** CSP control. Its manifest includes a separate MAIN-world helper; the formatted tree operates separately. A console block must not be mistaken for proof that its whole viewer failed. JSONVue likewise passed the strict-JSON CSP control. The live comparison combines JSONC syntax, MIME detection, and document policy; it cannot attribute all three competitors' raw output to sandboxing.

## How JSON All-in-One handled this source

The live run navigated from the raw source to its own packaged, top-level viewer, carrying the source URL and captureCommit=top-level. The tree preserved comment lines, and the first bindings object collapsed and reopened correctly. Its tested runtime contains the validated top-level-viewer route: the service worker checks its own viewer URL and the source/sender match before changing the tab location. This is an extension-page fallback, **not removal of the remote response CSP**. The normal no-CSP control stayed at the source URL with an embedded viewer; the CSP control used the top-level viewer.

![JSON All-in-One displaying the tested GitHub JSONC keymap](live-allinone-2026-10-08T08-22-50-532Z.png)

## Method and boundaries

- Full Chrome for Testing 150.0.7871.49 on Microsoft Windows 10 Pro 10.0.19045; executable SHA-256 `9baf374810f0f8e7152217fc769d62863a3197d2324567df6569f84281363c46`.
- Each attempt used one extension in a new temporary profile. The owned test tab was activated before navigation. Browser/GPU sandboxes remained enabled; no credentials, publisher profile, consent bypass, extension setting changes, or product edits.
- Runtime manifests/code/assets were copied byte-identically from the same CWS-delivered packages used in the separate large-file benchmark, then loaded **unpacked**. This is not an actual Store-installed-profile test. Original CRX signatures were not independently verified. Original _metadata/verified_contents.json is absent from the runtime copies; runtime code and manifests match their original extraction digests. Exact versions, IDs and CRX digests are in public-summary.json.
- Live UI observation bound: 20 seconds. Controls: 12 seconds. No performance ranking is claimed. Main and viewer visibility/focus are recorded in raw results. Every owned browser root exited with code 0; temporary profiles are retained privately for diagnosis.
- The local control removes only complete // comment lines from the fetched body, then verifies strict JSON.parse, seven root entries and the first binding. It retains the original data. The text/plain pair changes the full CSP header only (apart from a query label); the extra Viewer Pro pair uses application/json. They do not reproduce GitHub network/origin behavior.
- One initial AIO operation attempt had a malformed CSS selector; one JSONVue attempt per policy clicked an offscreen root control. Structured-view observations remain, but their operations are not counted as product failures. Fresh corrected attempts passed. All attempt IDs remain below.
- This does not certify all remote servers, policies, authenticated replay, incognito, other versions, or other file formats. It does not support the claim “competitors cannot work on sandboxed remote JSON.”

## Publication wording

“JSON All-in-One can display JSONC from the tested sandboxed GitHub raw URL. In our 8 October 2026 default-setting test, it opened an interactive tree where JSON Formatter, JSONVue and JSON Viewer Pro stayed raw. Strict-JSON controls showed that Formatter and JSONVue do support this CSP, so the exact-URL result should not be generalized to all sandboxed JSON.”

## Evidence and reproduction

Public-safe files: this report, public-summary.json and the referenced content-only screenshots. Do not publish copied extension packages, browser profiles, original large fixtures, or private launch logs. The separate large-file benchmark was left unchanged.

Runner: landing/manual/sandboxed-remote-20261008.mjs. Commands from repo root: `node landing/manual/sandboxed-remote-20261008.mjs all`, `controls`, `jsonvue-controls`, `viewerpro-mime-controls`. Regenerate summary with `node landing/manual/sandboxed-remote-20261008-report.mjs`. Source versions/hashes are frozen in the recorded evidence; reruns against the moving URL may differ.

| Run ID | Extension | Condition | Outcome / qualification |
|---|---|---|---|
| formatter-2026-10-08T08-20-42-611Z | formatter | live | Raw / no tree |
| jsonvue-2026-10-08T08-21-05-725Z | jsonvue | live | Raw / no tree |
| viewerpro-2026-10-08T08-21-29-008Z | viewerpro | live | Raw / no tree |
| allinone-2026-10-08T08-21-52-143Z | allinone | live | Invalid CSS selector in initial AIO operation; tree evidence retained, no product interaction conclusion |
| live-allinone-2026-10-08T08-22-50-532Z | allinone | live | Tree + interaction |
| control-csp-off-formatter-2026-10-08T08-23-11-355Z | formatter | control-csp-off | Tree + interaction |
| control-csp-on-formatter-2026-10-08T08-23-14-679Z | formatter | control-csp-on | Tree + interaction |
| control-csp-off-jsonvue-2026-10-08T08-23-17-946Z | jsonvue | control-csp-off | Initial root toggle was outside visible left edge; mouse hit did not qualify interaction; retained and repeated with visible bindings toggle |
| control-csp-on-jsonvue-2026-10-08T08-23-21-536Z | jsonvue | control-csp-on | Initial root toggle was outside visible left edge; mouse hit did not qualify interaction; retained and repeated with visible bindings toggle |
| control-csp-off-viewerpro-2026-10-08T08-23-25-053Z | viewerpro | control-csp-off | Raw / no tree |
| control-csp-on-viewerpro-2026-10-08T08-23-40-179Z | viewerpro | control-csp-on | Raw / no tree |
| control-csp-off-allinone-2026-10-08T08-23-55-459Z | allinone | control-csp-off | Tree + interaction |
| control-csp-on-allinone-2026-10-08T08-23-59-897Z | allinone | control-csp-on | Tree + interaction |
| control-csp-off-jsonvue-2026-10-08T08-25-14-559Z | jsonvue | control-csp-off | Tree + interaction |
| control-csp-on-jsonvue-2026-10-08T08-25-17-944Z | jsonvue | control-csp-on | Tree + interaction |
| control-appjson-csp-off-viewerpro-2026-10-08T08-25-21-214Z | viewerpro | control-appjson-csp-off | Tree + interaction |
| control-appjson-csp-on-viewerpro-2026-10-08T08-25-24-687Z | viewerpro | control-appjson-csp-on | Raw / no tree |