webstudio

0 Fork 0

mirror of https://github.com/webstudio-is/webstudio.git synced 2026-11-09 05:26:24 +09:00

T

Ivan Starkov ca41c505bd chore: Additional checks for the redirect_uri to avoid authorization code leakage (#4066 )

## Description

It was possible to use any builder subdomain for redirect_uri. What can
cause auth `code` leak.

Not a big deal having pkce but better to avoid as additional security
measure.


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file

2024-09-05 23:30:48 +03:00

.devcontainer

chore: Add gitclean and gitrebase to devcontainer (#4027 )

2024-08-31 08:28:14 +03:00

.github

fix: Support new project links in the cli (#4049 )

2024-09-02 16:59:06 +03:00

.storybook

build: upgrade storybook (#3915 )

2024-08-10 15:00:43 +02:00

.vscode

build: Add devcontainer (#3429 )

2024-05-28 14:15:55 +03:00

@types

chore: New Builder Auth (#4010 )

2024-08-29 12:38:39 +03:00

apps/builder

chore: Additional checks for the redirect_uri to avoid authorization code leakage (#4066 )

2024-09-05 23:30:48 +03:00

codemod

chore: use console.info instead of console.log (#3049 )

2024-03-24 12:52:46 +01:00

fixtures

fix: CLI, CORS does not allow synchronization in certain scenarios (#4056 )

2024-09-03 12:06:19 +03:00

https

chore: New Auth for the Projects (#3978 )

2024-08-21 22:16:30 +03:00

packages

chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047 )

2024-09-04 17:08:08 +03:00

patches

chore: Project login (#3990 )

2024-08-24 08:58:54 +03:00

.gitignore

chore: New Auth for the Projects (#3978 )

2024-08-21 22:16:30 +03:00

.nvmrc

chore: set node version to 20 in .nvmrc (#3423 )

2024-05-26 19:11:24 +03:00

.prettierignore

fix: Allow formatting d.ts files (#2558 )

2023-11-03 15:20:48 +02:00

CODE_OF_CONDUCT.md

Merge branch 'main' into feature-style-panel-flexChild-section

2022-11-12 11:36:44 +03:00

eslint.config.mjs

build: switch to eslint 9 (#3877 )

2024-08-05 09:23:57 +02:00

LICENSE

Change license from MIT to AGPL V3 (#1980 )

2023-07-26 01:06:21 +02:00

lostpixel.config.js

refactor: merge all storybooks into one (#3441 )

2024-05-29 17:05:17 +03:00

package.json

chore: Project login (#3990 )

2024-08-24 08:58:54 +03:00

pnpm-lock.yaml

feat: Add tooltips for individual properties in style panels by the descriptions generated by ai (#3964 )

2024-09-03 21:23:57 +05:30

pnpm-workspace.yaml

Add fixtures (#2254 )

2023-09-06 21:43:29 +03:00

README.md

docs: Update README.md (#2924 )

2024-02-18 11:36:30 +01:00

vercel.json

build: Test staging (Playground) (#3136 )

2024-04-12 11:03:45 +03:00

README.md

Webstudio is an Open Source Visual Development Platform for developers, designers, and cross-functional teams. You own the data, components, and infrastructure. You can use the hosted version or roll out your own.

Learning Resources

Thanks

Thanks to Lost Pixel for providing the visual testing platform that helps us review UI changes and catch visual regressions.

README.md

Learning Resources

Social Media

Thanks