Gen1 SDKs: Fix: XSS exploit (#3727)

## Description - disable editing unless within an iframe
BuilderIO · Nov 9, 2024 · dda2ba4 · dda2ba4
1 parent 152eff8
commit dda2ba4
Show file tree

Hide file tree

Showing 16 changed files with 731 additions and 265 deletions.
diff --git a/.changeset/blue-pots-tie.md b/.changeset/blue-pots-tie.md
@@ -0,0 +1,5 @@
+---
+"@builder.io/react": patch
+---
+
+Fix: Add `trustedHost` checks to all remaining event listeners
diff --git a/.changeset/five-wombats-peel.md b/.changeset/five-wombats-peel.md
@@ -0,0 +1,6 @@
+---
+"@builder.io/react": patch
+"@builder.io/sdk": patch
+---
+
+Fix: Restrict event listening to when `isEditing === true`
diff --git a/examples/react-js/.gitignore b/examples/react-js/.gitignore
@@ -22,3 +22,4 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
+.vercel