CKEditor links fail due to missing 'allow-forms' in ExtensionPage iframe sandbox

Description

When using the canvas module in combination with canvas_translate, adding links through the CKEditor interface fails.

The canvas_translate module imports CKEditor via @ckeditor/ckeditor5-react. This renders the extension inside an iframe with a restricted sandbox attribute:

<iframe sandbox="allow-scripts allow-same-origin allow-downloads" ...>

Because CKEditor uses a form to add links, the browser blocks this action due to the missing allow-forms permission in the sandbox configuration.

Proposed Solution / Workaround

Adding allow-forms to the sandbox attribute fixes the issue entirely. I patched this locally in canvas/ui/src/components/extensions/ExtensionPage.tsx:

// Before
sandbox="allow-scripts allow-same-origin allow-downloads"

// After
sandbox="allow-scripts allow-same-origin allow-downloads allow-forms"

The patch I use: allow-forms-in-ckeditor.patch

Additional Note

• Repository Location: I am reporting this here in the main canvas repository, but I am not entirely sure if this is the correct location, or if it should be reported under canvas_translate, or if it requires a coordinated fix between both.