mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-09 05:26:24 +09:00
## Description how it works https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292 - attack example https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/ - attack fixed https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/ corresponding PR #4060 (Add postMessage token to secure against Canvas script execution) Additionally csp on iframe (see comments) destination checks - to prevent including loaders/pages into iframes <img width="1015" alt="image" src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18"> ## Steps for reproduction 1. click button 2. expect xyz ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - test it on preview ## Before requesting a review - [ ] made a self-review - [ ] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [ ] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env` file
107 lines
3.2 KiB
TypeScript
107 lines
3.2 KiB
TypeScript
import { getStyleDeclKey, type WebstudioData } from "@webstudio-is/sdk";
|
|
import type { MarketplaceProduct } from "@webstudio-is/project-build";
|
|
import type { loader } from "~/routes/rest.data.$projectId";
|
|
import {
|
|
$assets,
|
|
$breakpoints,
|
|
$dataSources,
|
|
$instances,
|
|
$marketplaceProduct,
|
|
$pages,
|
|
$props,
|
|
$resources,
|
|
$styleSourceSelections,
|
|
$styleSources,
|
|
$styles,
|
|
} from "./nano-states";
|
|
import { fetch } from "~/shared/fetch.client";
|
|
|
|
export type BuilderData = WebstudioData & {
|
|
marketplaceProduct: undefined | MarketplaceProduct;
|
|
};
|
|
|
|
export const getBuilderData = (): BuilderData => {
|
|
const pages = $pages.get();
|
|
if (pages === undefined) {
|
|
throw Error(`Cannot get webstudio data with empty pages`);
|
|
}
|
|
return {
|
|
pages,
|
|
instances: $instances.get(),
|
|
props: $props.get(),
|
|
dataSources: $dataSources.get(),
|
|
resources: $resources.get(),
|
|
breakpoints: $breakpoints.get(),
|
|
styleSourceSelections: $styleSourceSelections.get(),
|
|
styleSources: $styleSources.get(),
|
|
styles: $styles.get(),
|
|
assets: $assets.get(),
|
|
marketplaceProduct: $marketplaceProduct.get(),
|
|
};
|
|
};
|
|
|
|
export const setBuilderData = (data: BuilderData) => {
|
|
$assets.set(data.assets);
|
|
$instances.set(data.instances);
|
|
$dataSources.set(data.dataSources);
|
|
$resources.set(data.resources);
|
|
// props should be after data sources to compute logic
|
|
$props.set(data.props);
|
|
$pages.set(data.pages);
|
|
$styleSources.set(data.styleSources);
|
|
$styleSourceSelections.set(data.styleSourceSelections);
|
|
$breakpoints.set(data.breakpoints);
|
|
$styles.set(data.styles);
|
|
$marketplaceProduct.set(data.marketplaceProduct);
|
|
};
|
|
|
|
const getPair = <Item extends { id: string }>(item: Item) =>
|
|
[item.id, item] as const;
|
|
|
|
export const loadBuilderData = async ({
|
|
projectId,
|
|
signal,
|
|
}: {
|
|
projectId: string;
|
|
signal: AbortSignal;
|
|
}) => {
|
|
const currentUrl = new URL(location.href);
|
|
const authToken = currentUrl.searchParams.get("authToken");
|
|
const url = new URL(`/rest/data/${projectId}`, currentUrl.origin);
|
|
if (authToken) {
|
|
url.searchParams.set("authToken", authToken);
|
|
}
|
|
const response = await fetch(url, { signal });
|
|
|
|
if (response.ok) {
|
|
const data: Awaited<ReturnType<typeof loader>> = await response.json();
|
|
return {
|
|
version: data.version,
|
|
assets: new Map(data.assets.map(getPair)),
|
|
instances: new Map(data.instances.map(getPair)),
|
|
dataSources: new Map(data.dataSources.map(getPair)),
|
|
resources: new Map(data.resources.map(getPair)),
|
|
props: new Map(data.props.map(getPair)),
|
|
pages: data.pages,
|
|
breakpoints: new Map(data.breakpoints.map(getPair)),
|
|
styleSources: new Map(data.styleSources.map(getPair)),
|
|
styleSourceSelections: new Map(
|
|
data.styleSourceSelections.map((item) => [item.instanceId, item])
|
|
),
|
|
styles: new Map(data.styles.map((item) => [getStyleDeclKey(item), item])),
|
|
marketplaceProduct: data.marketplaceProduct,
|
|
} satisfies BuilderData & { version: number };
|
|
}
|
|
|
|
const text = await response.text();
|
|
|
|
// No toasts available in this context
|
|
alert(
|
|
`Unable to load builder data. Response status: ${response.status}. Response text: ${text}`
|
|
);
|
|
|
|
throw Error(
|
|
`Unable to load builder data. Response status: ${response.status}. Response text: ${text}`
|
|
);
|
|
};
|