aleleba/figcraft
1
0
Fork 0
mirror of https://github.com/storytold/figcraft.git synced 2026-10-29 04:46:50 -06:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: refuse file and network access through path params and collab (#723)

Browse Source 
Plugins can no longer reach the disk or network through path parameters (variable.export/codeConnect.export/component.playground writes, codeConnect.import/variable.import reads) or through collab.* and window.*; found and fixed by @lucasmartins-ai, split out of #696.
This commit is contained in:
BFlat
2026-10-17 13:35:00 +07:00
committed by GitHub
parent 40c744da10
commit 69806c9edd
3 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plugins.md
+5 -1
View File
@@ -237,7 +237,11 @@ Whatever its manifest says, FigCraft refuses these calls (the plugin gets the re
it can handle):
- files and the app: `file.*`, `app.*`, `pref.*`, `help.*`, `library.add`, `libraries.*`,
`image.place` with a `path` (pass the image as base64 `data` instead), `view.theme*`;
`image.place` with a `path` (pass the image as base64 `data` instead), `variable.export`,
`codeConnect.export` and `component.playground` with a `path` (leave it out to get the result
back), `codeConnect.import` with a `path` and `variable.import` with a file path instead of JSON,
`window.*` (new windows open files), `view.theme*`;
- live sessions and online files: `collab.*`;
- other documents and the version history: `doc.*` and `version.*` (except `doc.list` and
`version.list`);
- the undo history and nesting: `edit.undo`, `edit.redo`, `edit.repeat`, `command.batch` (a run is