webstudio

0 Fork 0

mirror of https://github.com/webstudio-is/webstudio.git synced 2026-11-09 05:26:24 +09:00

T

Ivan Starkov 766d7eb95f chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047 )

## Description

how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/

corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)

Additionally

csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes

<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file

2024-09-04 17:08:08 +03:00

.devcontainer

chore: Add gitclean and gitrebase to devcontainer (#4027 )

2024-08-31 08:28:14 +03:00

.github

fix: Support new project links in the cli (#4049 )

2024-09-02 16:59:06 +03:00

.storybook

build: upgrade storybook (#3915 )

2024-08-10 15:00:43 +02:00

.vscode

build: Add devcontainer (#3429 )

2024-05-28 14:15:55 +03:00

@types

chore: New Builder Auth (#4010 )

2024-08-29 12:38:39 +03:00

apps/builder

chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047 )

2024-09-04 17:08:08 +03:00

codemod

chore: use console.info instead of console.log (#3049 )

2024-03-24 12:52:46 +01:00

fixtures

fix: CLI, CORS does not allow synchronization in certain scenarios (#4056 )

2024-09-03 12:06:19 +03:00

https

chore: New Auth for the Projects (#3978 )

2024-08-21 22:16:30 +03:00

packages

chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047 )

2024-09-04 17:08:08 +03:00

patches

chore: Project login (#3990 )

2024-08-24 08:58:54 +03:00

.gitignore

chore: New Auth for the Projects (#3978 )

2024-08-21 22:16:30 +03:00

.nvmrc

chore: set node version to 20 in .nvmrc (#3423 )

2024-05-26 19:11:24 +03:00

.prettierignore

fix: Allow formatting d.ts files (#2558 )

2023-11-03 15:20:48 +02:00

CODE_OF_CONDUCT.md

Merge branch 'main' into feature-style-panel-flexChild-section

2022-11-12 11:36:44 +03:00

eslint.config.mjs

build: switch to eslint 9 (#3877 )

2024-08-05 09:23:57 +02:00

LICENSE

Change license from MIT to AGPL V3 (#1980 )

2023-07-26 01:06:21 +02:00

lostpixel.config.js

refactor: merge all storybooks into one (#3441 )

2024-05-29 17:05:17 +03:00

package.json

chore: Project login (#3990 )

2024-08-24 08:58:54 +03:00

pnpm-lock.yaml

feat: Add tooltips for individual properties in style panels by the descriptions generated by ai (#3964 )

2024-09-03 21:23:57 +05:30

pnpm-workspace.yaml

Add fixtures (#2254 )

2023-09-06 21:43:29 +03:00

README.md

docs: Update README.md (#2924 )

2024-02-18 11:36:30 +01:00

vercel.json

build: Test staging (Playground) (#3136 )

2024-04-12 11:03:45 +03:00

README.md

Webstudio is an Open Source Visual Development Platform for developers, designers, and cross-functional teams. You own the data, components, and infrastructure. You can use the hosted version or roll out your own.

Learning Resources

Thanks

Thanks to Lost Pixel for providing the visual testing platform that helps us review UI changes and catch visual regressions.

README.md

Learning Resources

Social Media

Thanks