mirror/penpot

0 Fork 0

mirror of https://github.com/penpot/penpot.git synced 2026-09-12 21:59:43 -04:00

Files

T

Andrey Antukhandalonso.torres 5f1e151e84 🐛 Validate plugin UI URLs cannot target Penpot's own domain (#11273 )

* 🐛 Validate plugin UI URLs cannot target Penpot's own domain

The plugin UI iframe combines allow-scripts and allow-same-origin in
its sandbox. While necessary for plugins to use their own cookies and
storage, this creates a risk if a plugin's UI URL resolves to Penpot's
own origin, potentially allowing the iframe to escape sandbox isolation.

Add validateUIUrl() that checks the resolved URL against Penpot's
origin (from penpotPublicURI or location.origin) and throws if they
match. Called in openModal() after prepareUrl() resolves the URL.

Closes #11271

AI-assisted-by: qwen3.7-plus

* 💄 Fix prettier formatting in plugin-manager.spec.ts

Apply prettier formatting to fix format:check failure.

AI-assisted-by: qwen3.7-plus

* 🐛 Fix problem with penpot origin plugins

---------

Co-authored-by: alonso.torres <alonso.torres@kaleidos.net>

2026-09-08 09:23:20 +02:00

src

🐛 Validate plugin UI URLs cannot target Penpot's own domain (#11273 )

2026-09-08 09:23:20 +02:00

eslint.config.js

✨ Refresh dependencies on plugins directory (#9935 )

2026-06-01 10:07:06 +02:00

package-lock.json

🎉 Import penpot-plugins repository

2025-12-30 14:56:15 +01:00

package.json

⬆️ Update JVM, pnpm and node dependencies (#11404 )