mirror of
https://github.com/penpot/penpot.git
synced 2026-08-18 18:58:40 +00:00
d80cb5f2dc
The origin check added in the previous commit compared event.origin against window.location.origin (Penpot own origin). Since plugins are cross-origin by design (hosted on the plugin author domain), this check rejected every legitimate message from every real plugin. The event.source-based sender routing (matching iframeWindow identity) is the correct and sufficient security mechanism - it cannot be forged cross-origin, so the redundant origin check was removed. - Removed event.origin check from load-plugin.ts message listener - Updated tests to use realistic plugin origins (localhost:4202/4203) and to verify rejection based on source identity, not origin - Fixed documentation examples: use event.source for receiving validation and '*' for postMessage targetOrigin AI-assisted-by: mimo-v2.5-pro
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
corepack enable
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.