mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-10 06:24:35 +09:00
## Description how it works https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292 - attack example https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/ - attack fixed https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/ corresponding PR #4060 (Add postMessage token to secure against Canvas script execution) Additionally csp on iframe (see comments) destination checks - to prevent including loaders/pages into iframes <img width="1015" alt="image" src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18"> ## Steps for reproduction 1. click button 2. expect xyz ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - test it on preview ## Before requesting a review - [ ] made a self-review - [ ] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [ ] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env` file
20 lines
641 B
TypeScript
20 lines
641 B
TypeScript
// Our root outlet doesn't contain a layout because we have 2 types of documents: canvas and builder and we need to decide down the line which one to render, thre is no single root document.
|
|
import { Outlet, json, useLoaderData } from "@remix-run/react";
|
|
import { setEnv } from "@webstudio-is/feature-flags";
|
|
import env from "./env/env.server";
|
|
import { useSetFeatures } from "./shared/use-set-features";
|
|
|
|
export const loader = () => {
|
|
return json({
|
|
features: env.FEATURES,
|
|
});
|
|
};
|
|
|
|
export default function App() {
|
|
const { features } = useLoaderData<typeof loader>();
|
|
setEnv(features);
|
|
useSetFeatures();
|
|
|
|
return <Outlet />;
|
|
}
|