mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-09 05:26:24 +09:00
Ivan Starkov
766d7eb95f
## Description how it works https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292 - attack example https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/ - attack fixed https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/ corresponding PR #4060 (Add postMessage token to secure against Canvas script execution) Additionally csp on iframe (see comments) destination checks - to prevent including loaders/pages into iframes <img width="1015" alt="image" src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18"> ## Steps for reproduction 1. click button 2. expect xyz ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - test it on preview ## Before requesting a review - [ ] made a self-review - [ ] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [ ] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env` file