Ivan Starkov 87bfd994be chore: Add postMessage token to secure against Canvas script execution (#4060)
## Description


https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

See postMessage

Doesn't work as can be intercepted using `addEventListener`.

## Steps for reproduction

In chrome dev console in window and canvas context 

```js
globalThis.postMessage = (...args) => console.log(...args); // no messages
```

```js
globalThis.postMessage({
    "action": {
        "type": "sendStoreData",
        "payload": {
            "source": "builder",
            "data": [
                {
                    "namespace": "hoveredInstanceSelector",
                    "value": [
                        "w2emY6HYI160BmYG9WA6C",
                        "_BKGofOEhOFV_zLiN0iZk"
                    ]
                }
            ]
        }
    },
    "token": "development-token-2"
}, '*'); // Error in console "Invalid token"
```

```js
window["__webstudio__$__api_token"] // is undefined
```


```js
window.addEventListener(
    "message",
    e=>console.log({...e.data}), {capture: true}); // token prop is undefined
```

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-04 14:07:56 +03:00
2024-05-28 14:15:55 +03:00
2024-08-29 12:38:39 +03:00
2024-08-24 08:58:54 +03:00
2024-08-24 08:58:54 +03:00
2023-09-06 21:43:29 +03:00
2024-02-18 11:36:30 +01:00

builder-screenshot

Webstudio is an Open Source Visual Development Platform for developers, designers, and cross-functional teams. You own the data, components, and infrastructure. You can use the hosted version or roll out your own.


Learning Resources

Social Media

Thanks

Lost Pixel

Thanks to Lost Pixel for providing the visual testing platform that helps us review UI changes and catch visual regressions.

Languages
TypeScript 98.9%
PLpgSQL 0.5%
CSS 0.3%
Shell 0.2%
JavaScript 0.1%