mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-10-23 03:27:27 +09:00
Oleg Isonen
54d720b185
## Summary - Require authenticated project view permission on the resources-loader endpoint. - Restrict external resource fetches to HTTP(S) destinations with public IPs, pin DNS resolution to the validated socket address, and revalidate redirect targets. - Limit outbound connection origins and strip sensitive headers on cross-origin redirects. ## Validation - `oxfmt` and `oxlint` pass for the changed files. - Workspace TypeScript checking reports extensive unrelated missing workspace dependency/type errors; no diagnostics were reported for the changed files. - Tests were not run.
Learning Resources
Social Media
License
- Webstudio core (all functionality in this repository) is free/open-source under AGPL-3.0-or-later.
- sdk-components-animation package (optional) is proprietary. You must accept the Webstudio, Inc. EULA located in sdk-components-animation/LICENSE before using it.