webstudio

0 Fork 0

mirror of https://github.com/webstudio-is/webstudio.git synced 2026-11-09 05:26:24 +09:00

Files

T

Ivan Starkov 87bfd994be chore: Add postMessage token to secure against Canvas script execution (#4060 )

## Description


https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

See postMessage

Doesn't work as can be intercepted using `addEventListener`.

## Steps for reproduction

In chrome dev console in window and canvas context 

```js
globalThis.postMessage = (...args) => console.log(...args); // no messages
```

```js
globalThis.postMessage({
    "action": {
        "type": "sendStoreData",
        "payload": {
            "source": "builder",
            "data": [
                {
                    "namespace": "hoveredInstanceSelector",
                    "value": [
                        "w2emY6HYI160BmYG9WA6C",
                        "_BKGofOEhOFV_zLiN0iZk"
                    ]
                }
            ]
        }
    },
    "token": "development-token-2"
}, '*'); // Error in console "Invalid token"
```

```js
window["__webstudio__$__api_token"] // is undefined
```


```js
window.addEventListener(
    "message",
    e=>console.log({...e.data}), {capture: true}); // token prop is undefined
```

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file

2024-09-04 14:07:56 +03:00