 Ivan Starkov
|
766d7eb95f
|
chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description
how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292
- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/
corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)
Additionally
csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes
<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
|
2024-09-04 17:08:08 +03:00 |
|