Files
webstudio/apps/builder/app/shared/builder-data.ts
T
Ivan Starkov 766d7eb95f chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description

how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/

corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)

Additionally

csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes

<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-04 17:08:08 +03:00

107 lines
3.2 KiB
TypeScript

import { getStyleDeclKey, type WebstudioData } from "@webstudio-is/sdk";
import type { MarketplaceProduct } from "@webstudio-is/project-build";
import type { loader } from "~/routes/rest.data.$projectId";
import {
$assets,
$breakpoints,
$dataSources,
$instances,
$marketplaceProduct,
$pages,
$props,
$resources,
$styleSourceSelections,
$styleSources,
$styles,
} from "./nano-states";
import { fetch } from "~/shared/fetch.client";
export type BuilderData = WebstudioData & {
marketplaceProduct: undefined | MarketplaceProduct;
};
export const getBuilderData = (): BuilderData => {
const pages = $pages.get();
if (pages === undefined) {
throw Error(`Cannot get webstudio data with empty pages`);
}
return {
pages,
instances: $instances.get(),
props: $props.get(),
dataSources: $dataSources.get(),
resources: $resources.get(),
breakpoints: $breakpoints.get(),
styleSourceSelections: $styleSourceSelections.get(),
styleSources: $styleSources.get(),
styles: $styles.get(),
assets: $assets.get(),
marketplaceProduct: $marketplaceProduct.get(),
};
};
export const setBuilderData = (data: BuilderData) => {
$assets.set(data.assets);
$instances.set(data.instances);
$dataSources.set(data.dataSources);
$resources.set(data.resources);
// props should be after data sources to compute logic
$props.set(data.props);
$pages.set(data.pages);
$styleSources.set(data.styleSources);
$styleSourceSelections.set(data.styleSourceSelections);
$breakpoints.set(data.breakpoints);
$styles.set(data.styles);
$marketplaceProduct.set(data.marketplaceProduct);
};
const getPair = <Item extends { id: string }>(item: Item) =>
[item.id, item] as const;
export const loadBuilderData = async ({
projectId,
signal,
}: {
projectId: string;
signal: AbortSignal;
}) => {
const currentUrl = new URL(location.href);
const authToken = currentUrl.searchParams.get("authToken");
const url = new URL(`/rest/data/${projectId}`, currentUrl.origin);
if (authToken) {
url.searchParams.set("authToken", authToken);
}
const response = await fetch(url, { signal });
if (response.ok) {
const data: Awaited<ReturnType<typeof loader>> = await response.json();
return {
version: data.version,
assets: new Map(data.assets.map(getPair)),
instances: new Map(data.instances.map(getPair)),
dataSources: new Map(data.dataSources.map(getPair)),
resources: new Map(data.resources.map(getPair)),
props: new Map(data.props.map(getPair)),
pages: data.pages,
breakpoints: new Map(data.breakpoints.map(getPair)),
styleSources: new Map(data.styleSources.map(getPair)),
styleSourceSelections: new Map(
data.styleSourceSelections.map((item) => [item.instanceId, item])
),
styles: new Map(data.styles.map((item) => [getStyleDeclKey(item), item])),
marketplaceProduct: data.marketplaceProduct,
} satisfies BuilderData & { version: number };
}
const text = await response.text();
// No toasts available in this context
alert(
`Unable to load builder data. Response status: ${response.status}. Response text: ${text}`
);
throw Error(
`Unable to load builder data. Response status: ${response.status}. Response text: ${text}`
);
};