mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-06 12:04:00 +09:00
Ivan Starkov
8cdc103263
## Description Add simple protection against non js and jsdom bots Idea is to add hidden js generated field on submit, and check that matchMedia is working. ## Steps for reproduction Go here https://saas-form-rdlrc.wstd.work/ then check via curl ```bash curl 'https://saas-form-rdlrc.wstd.work/?index=&_data=routes%2F_index' \ -H 'content-type: application/x-www-form-urlencoded;charset=UTF-8' \ -H 'referer: https://saas-form-rdlrc.wstd.work/' \ --data-raw 'ws--form-id=2TIgyB2vQViDMitiYiGSK&name=wewe&email=wewe&ws--form-bot=18f72a6' curl 'https://saas-form-rdlrc.wstd.work/?index=&_data=routes%2F_index' \ -H 'content-type: application/x-www-form-urlencoded;charset=UTF-8' \ -H 'referer: https://saas-form-rdlrc.wstd.work/' \ --data-raw 'ws--form-id=2TIgyB2vQViDMitiYiGSK&name=wewe&email=wewe' curl 'https://saas-form-rdlrc.wstd.work/?index=&_data=routes%2F_index' \ -H 'content-type: application/x-www-form-urlencoded;charset=UTF-8' \ -H 'referer: https://saas-form-rdlrc.wstd.work/' \ --data-raw 'ws--form-id=2TIgyB2vQViDMitiYiGSK&name=wewe&email=wewe&ws--form-bot=jsdom' ``` ## Code Review - [ ] hi @kof, I need you to do - conceptual review (architecture, feature-correctness) - detailed review (read every line) - test it on preview ## Before requesting a review - [ ] made a self-review - [ ] added inline comments where things may be not obvious (the "why", not "what") ## Before merging - [ ] tested locally and on preview environment (preview dev login: 5de6) - [ ] updated [test cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md) document - [ ] added tests - [ ] if any new env variables are added, added them to `.env.example` and the `builder/env-check.js` if mandatory