Raphaël Bosi
4d520a312f
Fixes https://github.com/twentyhq/twenty/issues/19899 Front component iframes were previously forced to `sandbox=""`, which fully locks them down: no scripts, no forms, no popups. That broke any legitimate embedded content (maps, widgets, embeds) developers tried to render. But we can't just trust the app-provided sandbox value either: tokens like allow-same-origin or allow-top-navigation would let a malicious embed escape the sandbox and hijack the host Twenty tab. - Add `sanitizeIframeSandbox`, which keeps the iframe useful while enforcing security: applies a safe default (allow-scripts allow-forms allow-popups) when no sandbox is set always forces allow-scripts so embeds work - strips dangerous tokens (`allow-same-origin`, all `allow-top-navigation`*, `allow-popups-to-escape-sandbox`), case-insensitively - Wire it into `createHtmlHostWrapper` so every `iframe` rendered by a front component is sanitized. - Add unit tests for the sanitizer and Storybook interaction tests asserting dangerous sandboxes are stripped.
39 lines
1.1 KiB
JavaScript
39 lines
1.1 KiB
JavaScript
import { readFileSync } from 'fs';
|
|
import { dirname, resolve } from 'path';
|
|
import { pathsToModuleNameMapper } from 'ts-jest';
|
|
import { fileURLToPath } from 'url';
|
|
|
|
const __filename = fileURLToPath(import.meta.url);
|
|
const __dirname = dirname(__filename);
|
|
|
|
const tsConfigPath = resolve(__dirname, './tsconfig.json');
|
|
const tsConfig = JSON.parse(readFileSync(tsConfigPath, 'utf8'));
|
|
|
|
const jestConfig = {
|
|
displayName: 'twenty-front-component-renderer',
|
|
preset: '../../jest.preset.js',
|
|
testEnvironment: 'jsdom',
|
|
transformIgnorePatterns: ['../../node_modules/'],
|
|
transform: {
|
|
'^.+\\.[tj]sx?$': [
|
|
'@swc/jest',
|
|
{
|
|
jsc: {
|
|
parser: { syntax: 'typescript', tsx: true },
|
|
transform: { react: { runtime: 'automatic' } },
|
|
},
|
|
},
|
|
],
|
|
},
|
|
moduleNameMapper: {
|
|
...pathsToModuleNameMapper(tsConfig.compilerOptions.paths, {
|
|
prefix: '<rootDir>/',
|
|
}),
|
|
},
|
|
moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx'],
|
|
extensionsToTreatAsEsm: ['.ts', '.tsx'],
|
|
coverageDirectory: './coverage',
|
|
};
|
|
|
|
export default jestConfig;
|