mirror of
https://github.com/penpot/penpot.git
synced 2026-07-31 09:31:44 -04:00
20e67af9f6
The global postMessage listener was broadcasting incoming messages to all loaded plugins without validating the origin or routing to the correct sender. This allowed any plugin (or any iframe from any origin) to inject messages into other plugins. - Added origin validation — messages from origins other than window.location.origin are rejected. - Added sender-based routing — a message is only delivered to the plugin whose iframe contentWindow matches event.source. - Exposed iframeWindow getters in PluginManager, PluginModalElement, and createPlugin so the runtime can compare event.source against the correct iframe reference. - Updated documentation examples to include origin validation and recommend window.location.origin over '*' for postMessage targetOrigin. AI-assisted-by: qwen3.7-plus
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
corepack enable
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.