mirror of https://github.com/penpot/penpot.git synced 2026-08-30 08:39:19 +00:00

History

Andrey Antukh 3a9a0932a3 🐛 Validate plugin UI URLs cannot target Penpot's own domain

The plugin UI iframe combines allow-scripts and allow-same-origin in
its sandbox. While necessary for plugins to use their own cookies and
storage, this creates a risk if a plugin's UI URL resolves to Penpot's
own origin, potentially allowing the iframe to escape sandbox isolation.

Add validateUIUrl() that checks the resolved URL against Penpot's
origin (from penpotPublicURI or location.origin) and throws if they
match. Called in openModal() after prepareUrl() resolves the URL.

Closes #11271

AI-assisted-by: qwen3.7-plus

2026-08-18 17:15:39 +00:00

src

🐛 Validate plugin UI URLs cannot target Penpot's own domain

2026-08-18 17:15:39 +00:00

eslint.config.js

✨ Refresh dependencies on plugins directory (#9935 )

2026-06-01 10:07:06 +02:00

package-lock.json

🎉 Import penpot-plugins repository

2025-12-30 14:56:15 +01:00

package.json

⬆️ Update pnpm dependencies across all modules