Commit Graph
12 Commits
Author SHA1 Message Date
Oleg Isonen b8a194c011 feat: Workspaces (#5641) 2026-04-08 21:58:20 +02:00
Ivan Starkov 069376f8e9 fix: Rate limit on shared link clicks (#4715)
## Description

closes #4403

We have no way to show good errors on naviagation errors (remix does not
support this)

Here I reduced amount of reloads on link clicks on preview

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
0000)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2025-01-05 10:55:24 +03:00
Ivan Starkov 766d7eb95f chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description

how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/

corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)

Additionally

csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes

<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-04 17:08:08 +03:00
Ivan Starkov 89e9748129 chore: Make code "Remix" friendly (#4005)
## Description

Make code "remix" friendly.

- [x] - Remove specific handlers for canvas and builder
- [x] - Use naive remix root.tsx entri.client and entri.server (we do
not use hydrate on client, we inject stitches on the server, anything
else is the same as in default remix project)
- [x] - Use `_ui` layout for builder, dashboard and login pages
- [x] - Render canvas layout in $.tsx
- [x] - Remove root.tsx 


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-08-24 07:55:20 +03:00
Bogdan Chadkin ae79d9f133 refactor: drop env interop (#3109)
Here got rid from client-server env interop which will stop working
outside of node-like environment.
2024-04-07 00:55:42 +07:00
Bogdan Chadkin eb5e9200d9 refactor: drop unused sentry (#3100)
We do not use sentry 1 year (since 5 april 2023).
Better get rid of for now to not block updates.
2024-04-05 23:21:45 +07:00
Giuseppe 21cbb09f0e feat: Enable features via url (#2459)
Allows to enable features from the /dashboard endpoint by setting it via `features` url param
2023-10-12 19:35:18 +02:00
Bogdan Chadkin 4460bba4ae Remove global tooltip provider (#2012)
Radix provider in canvas couples too tight with radix we should go the
other way. Here wrapped each
tooltip sdk component with provider and wrapped
with provider in builder instead of root.
2023-07-31 21:51:17 +04:00
Bogdan Chadkin f018ff9451 Upload assets with native fetch (#1583)
Remix fetcher introduce constraints for own server implementation. For
example body can be FormData, object or string and FormData requires
custom stream parser (they provide one).

Though streaming blob much simpler task and can be done with native
streams.

Another constraint is request cancelation when component is unmounted.
We workaround this with global persistent fetcher. Though native fetch
does not require this workaround too.
2023-05-11 18:59:51 +07:00
Ivan Starkov 012e54e465 Fix sentry error (#1137)
## Description

1. What is this PR about (link the issue and add a short description)

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-builder/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2023-02-27 22:11:45 +03:00
Oleg Isonen 431d1f9e60 Upgrade sentry to 7.38 (#1132)
## Description

Just upgrading in hope to get rid of some logs in sentry that seem
unrelated to our code base


https://webstudio.sentry.io/issues/3863782544/?project=6530661&query=is%3Aunresolved&referrer=issue-stream

## Code Review

- [ ] hi @TrySound , I need you to do
  - conceptual review (architecture, feature-correctness)

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-builder/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2023-02-27 16:31:26 +01:00
Andras Bacsai ac413cdd5f rename designer to builder 2023-02-14 11:15:24 +01:00