mirror of
https://github.com/penpot/penpot.git
synced 2026-11-12 13:00:37 +00:00
5f1e151e84
* 🐛 Validate plugin UI URLs cannot target Penpot's own domain The plugin UI iframe combines allow-scripts and allow-same-origin in its sandbox. While necessary for plugins to use their own cookies and storage, this creates a risk if a plugin's UI URL resolves to Penpot's own origin, potentially allowing the iframe to escape sandbox isolation. Add validateUIUrl() that checks the resolved URL against Penpot's origin (from penpotPublicURI or location.origin) and throws if they match. Called in openModal() after prepareUrl() resolves the URL. Closes #11271 AI-assisted-by: qwen3.7-plus * 💄 Fix prettier formatting in plugin-manager.spec.ts Apply prettier formatting to fix format:check failure. AI-assisted-by: qwen3.7-plus * 🐛 Fix problem with penpot origin plugins --------- Co-authored-by: alonso.torres <alonso.torres@kaleidos.net>
45 lines
1.1 KiB
TypeScript
45 lines
1.1 KiB
TypeScript
export function getPenpotOrigin(): string {
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
const publicUri = (globalThis as any).penpotPublicURI;
|
|
if (publicUri) {
|
|
try {
|
|
return new URL(publicUri).origin;
|
|
} catch {
|
|
// fall through to location.origin
|
|
}
|
|
}
|
|
return globalThis.location.origin;
|
|
}
|
|
|
|
/**
|
|
* Whether the given URL is served from Penpot's own origin. Unparseable URLs
|
|
* are considered external.
|
|
*/
|
|
export function isPenpotOrigin(url: string): boolean {
|
|
try {
|
|
return new URL(url).origin === getPenpotOrigin();
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Rejects UI URLs that resolve to Penpot's own origin, which would let the
|
|
* plugin iframe escape its sandbox isolation.
|
|
*
|
|
* Plugins whose manifest is itself served from Penpot's origin are part of the
|
|
* instance and are exempt from the check.
|
|
*/
|
|
export function validateUIUrl(url: string, manifestHost: string): void {
|
|
if (isPenpotOrigin(manifestHost)) {
|
|
return;
|
|
}
|
|
|
|
const parsed = new URL(url);
|
|
if (parsed.origin === getPenpotOrigin()) {
|
|
throw new Error(
|
|
`Plugin UI URL must not point to Penpot's own domain: ${url}`,
|
|
);
|
|
}
|
|
}
|