From 9c2c0e6c42a7fd07a5381b2bbe8c15f444b8d88d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <andras.bacsai@gmail.com>
Date: Mon, 21 Nov 2022 11:30:01 +0100
Subject: [PATCH 1/3] fix: missing dependency (detect-font)

---
 packages/react-sdk/package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/react-sdk/package.json b/packages/react-sdk/package.json
index ceb0a5c6c5..08ec4b8c7f 100644
--- a/packages/react-sdk/package.json
+++ b/packages/react-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webstudio-is/react-sdk",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Webstudio JavaScript / TypeScript API",
   "author": "Webstudio <github@webstudio.is>",
   "homepage": "https://webstudio.is",
@@ -56,6 +56,7 @@
     "zod": "^3.19.1"
   },
   "dependencies": {
+    "detect-font": "^0.1.5",
     "@webstudio-is/asset-uploader": "^*",
     "@webstudio-is/fonts": "*",
     "@webstudio-is/icons": "*",

From 13e0a63014ff07b6e0b0a4e72ebdc4c614b8ea65 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <andras.bacsai@gmail.com>
Date: Mon, 21 Nov 2022 11:31:24 +0100
Subject: [PATCH 2/3] do not run tests on main push

---
 .github/workflows/package-tests.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/package-tests.yml b/.github/workflows/package-tests.yml
index 22d99b54a6..e3de574eea 100644
--- a/.github/workflows/package-tests.yml
+++ b/.github/workflows/package-tests.yml
@@ -5,6 +5,8 @@ on:
       - "packages/**/*"
       - ".github/workflows/package-tests.yml"
       - ".github/actions/publish-test/action.yaml"
+    branches-ignore:
+      - "main"
 jobs:
   publish-test:
     runs-on: ubuntu-latest

From 559318bd224a6eccf3ef8b98503e40aa483844f5 Mon Sep 17 00:00:00 2001
From: Roman Pominov <rpominov+github@gmail.com>
Date: Mon, 21 Nov 2022 14:37:15 +0400
Subject: [PATCH 3/3] Fix a security issue with eval() (#485)

In the current main if you enter `1+1,alert("hello")` as a value into a
CSS input, you'll see an alert. This PR fixes it.
---
 .../style-panel/shared/parse-css-value.ts     | 43 +++++++++++--------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/apps/designer/app/designer/features/style-panel/shared/parse-css-value.ts b/apps/designer/app/designer/features/style-panel/shared/parse-css-value.ts
index e127d845bf..16d253c65d 100644
--- a/apps/designer/app/designer/features/style-panel/shared/parse-css-value.ts
+++ b/apps/designer/app/designer/features/style-panel/shared/parse-css-value.ts
@@ -22,31 +22,36 @@ export const isValid = (property: string, value: string): boolean => {
   return true;
 };
 
-// wtf?
-// eslint-disable-next-line no-useless-escape
-const mathRegex = /[\+\-\*\/]/;
+// If expression is a math expression, evaluates it.
+// Otherwise returns undefined.
+const evaluateMath = (expression: string) => {
+  if (/^[\d\s.+*/-]+$/.test(expression) === false) {
+    return undefined;
+  }
+  try {
+    // Eval is safe here because of the regex above
+    const result = eval(`(${expression})`);
+    if (typeof result === "number") {
+      return result;
+    }
+  } catch (err) {
+    return undefined;
+  }
+};
 
 // - 2+2px
 // - 2*2
 const evaluate = (input: string, parsedUnit: [Unit] | null) => {
-  const parsed = parseFloat(input);
-  // If its not a number, it can't be a math expression.
-  if (isNaN(parsed)) return parsed;
+  const result = evaluateMath(
+    parsedUnit === null ? input : input.replace(parsedUnit[0], "")
+  );
 
-  // It's a math expression
-  if (mathRegex.test(input)) {
-    // Get rid of the unit
-    if (parsedUnit !== null) {
-      input = input.replace(parsedUnit[0], "");
-    }
-    try {
-      return eval(`(${input})`);
-    } catch (err) {
-      return parsed;
-    }
+  if (result !== undefined) {
+    return result;
   }
 
-  return parsed;
+  const number = parseFloat(input);
+  return isNaN(number) ? undefined : number;
 };
 
 // Helper to let user input:
@@ -73,7 +78,7 @@ export const parseCssValue = (
 
   // If we get a unit but there is no number - we assume its an accidental
   // unit match and its a keyword value.
-  if (isNaN(number) === true) {
+  if (number === undefined) {
     if (isValid(property, input)) {
       return {
         type: "keyword",