Files
twenty/packages/twenty-front/src/modules/front-components/components/FrontComponentRenderer.tsx
T
Raphaël Bosi 2899058b5f Warn users before front components navigate to an external site (#23270)
https://github.com/user-attachments/assets/af3fb042-d066-4e0c-9348-f86ea92a6fcd



Front component anchors render a real host `<a>`, so clicking a link to
another domain performed an uncontrolled full-page navigation. This adds
a phishing-resistant "you're leaving Twenty" confirmation modal before
navigating to an external origin (Fixes
[#23260](https://github.com/twentyhq/twenty/issues/23260)).

The renderer intercepts external anchor clicks in
`createHtmlHostWrapper` and hands the destination to a host callback via
context; twenty-front owns the modal (reuses `ConfirmationModal`) and a
per-application list of trusted origins persisted in localStorage. A
"Don't ask again for this site" checkbox (checked by default) skips the
modal next time for that app.

Scope is external cross-origin http(s) links only; same-origin links
keep native behavior. External links always open in a new tab, so a
component can never navigate the Twenty tab away, even once its origin
is trusted. The modal is rendered by the trusted host, so components
cannot style or suppress it.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23270?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
2026-07-27 13:21:38 +00:00

175 lines
6.0 KiB
TypeScript

import { FrontComponentApplicationTokenPairEffect } from '@/front-components/components/FrontComponentApplicationTokenPairEffect';
import { FrontComponentLoadErrorSnackBarEffect } from '@/front-components/components/FrontComponentLoadErrorSnackBarEffect';
import { FrontComponentRendererProvider } from '@/front-components/components/FrontComponentRendererProvider';
import { useFrontComponentExecutionContext } from '@/front-components/hooks/useFrontComponentExecutionContext';
import { useOnApplicationSdkClientChecksumsUpdated } from '@/front-components/hooks/useOnApplicationSdkClientChecksumsUpdated';
import { useOnFrontComponentUpdated } from '@/front-components/hooks/useOnFrontComponentUpdated';
import { useRequestFrontComponentExternalNavigation } from '@/front-components/hooks/useRequestFrontComponentExternalNavigation';
import { getFrontComponentUrl } from '@/front-components/utils/getFrontComponentUrl';
import { getSdkClientUrls } from '@/front-components/utils/getSdkClientUrls';
import { useGetLogicFunctionHttpUrl } from '@/settings/logic-functions/hooks/useGetLogicFunctionHttpUrl';
import { useSnackBar } from '@/ui/feedback/snack-bar-manager/hooks/useSnackBar';
import { useQuery } from '@apollo/client/react';
import { t } from '@lingui/core/macro';
import { type ReactNode, useCallback, useContext, useMemo } from 'react';
import { FrontComponentRenderer as SharedFrontComponentRenderer } from 'twenty-front-component-renderer';
import { isDefined } from 'twenty-shared/utils';
import { ThemeContext } from 'twenty-ui/theme-constants';
import { REACT_APP_SERVER_BASE_URL } from '~/config';
import {
FindOneFrontComponentDocument,
type FindOneFrontComponentQuery,
GetApplicationSdkClientChecksumsDocument,
} from '~/generated-metadata/graphql';
type FrontComponentRendererProps = {
frontComponentId: string;
commandMenuItemId?: string;
selectedRecordIds?: string[];
loadingFallback?: ReactNode;
};
type ResolvedFrontComponent = NonNullable<
FindOneFrontComponentQuery['frontComponent']
>;
type FrontComponentRendererContentProps = {
frontComponent: ResolvedFrontComponent;
commandMenuItemId?: string;
selectedRecordIds?: string[];
loadingFallback?: ReactNode;
};
export const FrontComponentRenderer = ({
frontComponentId,
commandMenuItemId,
selectedRecordIds,
loadingFallback,
}: FrontComponentRendererProps) => {
const { data, loading, error } = useQuery(FindOneFrontComponentDocument, {
variables: { id: frontComponentId },
});
useOnFrontComponentUpdated({
frontComponentId,
});
const frontComponent = data?.frontComponent;
return (
<>
<FrontComponentLoadErrorSnackBarEffect errorMessage={error?.message} />
{loading && loadingFallback}
{!loading && isDefined(frontComponent) && (
<FrontComponentRendererContent
frontComponent={frontComponent}
commandMenuItemId={commandMenuItemId}
selectedRecordIds={selectedRecordIds}
loadingFallback={loadingFallback}
/>
)}
</>
);
};
const FrontComponentRendererContent = ({
frontComponent,
commandMenuItemId,
selectedRecordIds,
loadingFallback,
}: FrontComponentRendererContentProps) => {
const { colorScheme } = useContext(ThemeContext);
const { enqueueErrorSnackBar } = useSnackBar();
const { functionsBaseUrl } = useGetLogicFunctionHttpUrl();
const { id: frontComponentId, applicationId, usesSdkClient } = frontComponent;
const { executionContext, frontComponentHostCommunicationApi } =
useFrontComponentExecutionContext({
frontComponentId,
commandMenuItemId,
selectedRecordIds,
colorScheme,
});
const requestExternalNavigation = useRequestFrontComponentExternalNavigation({
applicationId,
});
const handleError = useCallback(
(error?: Error) => {
if (!isDefined(error)) {
return;
}
enqueueErrorSnackBar({
message: t`Failed to load front component: ${error.message}`,
});
},
[enqueueErrorSnackBar],
);
const applicationTokenPair = frontComponent.applicationTokenPair ?? null;
const { data: sdkClientChecksumsData, loading: sdkClientChecksumsLoading } =
useQuery(GetApplicationSdkClientChecksumsDocument, {
variables: { applicationId },
skip: !usesSdkClient,
});
useOnApplicationSdkClientChecksumsUpdated({
applicationId,
skip: !usesSdkClient,
});
const sdkClientChecksums =
sdkClientChecksumsData?.applicationSdkClientChecksums;
const sdkClientUrls = useMemo(
() => getSdkClientUrls(applicationId, sdkClientChecksums),
[applicationId, sdkClientChecksums],
);
const componentUrl = getFrontComponentUrl({
frontComponentId,
checksum: frontComponent.builtComponentChecksum,
});
const applicationVariables = frontComponent.applicationVariables ?? undefined;
const isSdkClientReady = !usesSdkClient || !sdkClientChecksumsLoading;
const isReadyToRender = isDefined(applicationTokenPair) && isSdkClientReady;
return (
<>
<FrontComponentApplicationTokenPairEffect
frontComponentId={frontComponentId}
applicationTokenPair={applicationTokenPair}
/>
{!isReadyToRender && loadingFallback}
{isReadyToRender && (
<FrontComponentRendererProvider frontComponentId={frontComponentId}>
<SharedFrontComponentRenderer
colorScheme={colorScheme}
componentUrl={componentUrl}
applicationAccessToken={
applicationTokenPair.applicationAccessToken.token
}
apiUrl={REACT_APP_SERVER_BASE_URL}
functionsBaseUrl={functionsBaseUrl}
sdkClientUrls={sdkClientUrls}
executionContext={executionContext}
frontComponentHostCommunicationApi={
frontComponentHostCommunicationApi
}
onRequestExternalNavigation={requestExternalNavigation}
applicationVariables={applicationVariables}
onError={handleError}
loadingFallback={loadingFallback}
/>
</FrontComponentRendererProvider>
)}
</>
);
};