mirror of https://github.com/penpot/penpot.git synced 2026-08-19 03:08:40 +00:00

History

Andrey Antukh d80cb5f2dc 🐛 Fix plugin origin check breaking cross-origin plugin messaging

The origin check added in the previous commit compared event.origin
against window.location.origin (Penpot own origin). Since plugins
are cross-origin by design (hosted on the plugin author domain),
this check rejected every legitimate message from every real plugin.

The event.source-based sender routing (matching iframeWindow identity)
is the correct and sufficient security mechanism - it cannot be forged
cross-origin, so the redundant origin check was removed.

- Removed event.origin check from load-plugin.ts message listener
- Updated tests to use realistic plugin origins (localhost:4202/4203)
  and to verify rejection based on source identity, not origin
- Fixed documentation examples: use event.source for receiving
  validation and '*' for postMessage targetOrigin

AI-assisted-by: mimo-v2.5-pro

2026-08-17 10:37:03 +00:00

src

🐛 Fix plugin origin check breaking cross-origin plugin messaging

2026-08-17 10:37:03 +00:00

eslint.config.js

✨ Refresh dependencies on plugins directory (#9935 )

2026-06-01 10:07:06 +02:00

package-lock.json

🎉 Import penpot-plugins repository

2025-12-30 14:56:15 +01:00

package.json

⬆️ Update pnpm dependencies across all modules