 Ivan Starkov
|
9348ce0af0
|
fix: Image upload via share link (#4083)
## Description
Use authToken token implicitly. Except queue cases like image upload and
patches.
## Steps for reproduction
Open any project with build or admin share link, upload image.
https://p-a82eaa2b-698e-4d3f-aa46-d4f3eee05fe0-dot-img-fix.development.webstudio.is/?authToken=a74ddf79-2638-47af-9dd1-e62f78187a8d&mode=edit
<img width="1025" alt="image"
src="https://github.com/user-attachments/assets/1de48271-f8c3-4df8-aa51-e61d74eb5c32">
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
|
2024-09-07 18:43:03 +03:00 |
|
|
Ivan Starkov
|
766d7eb95f
|
chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description
how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292
- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/
corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)
Additionally
csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes
<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
|
2024-09-04 17:08:08 +03:00 |
|