mirror of
https://github.com/twentyhq/twenty
synced 2026-04-21 13:37:22 +00:00
dd67109594
https://sonarly.com/issue/29143?type=bug Custom front components that render iframes get a force-applied `sandbox=""` attribute (most restrictive possible), overriding any developer-supplied sandbox value and blocking JavaScript, forms, popups, and same-origin access inside the iframe. Fix: Changed `createHtmlHostWrapper.ts` with two fixes: 1. **Changed sandbox default value from `''` to `'allow-scripts allow-forms allow-popups'`** — The empty string `sandbox=""` is the most restrictive possible value per HTML spec (blocks all scripts, forms, popups, same-origin access). The new default allows JavaScript execution, form submission, and popups — which are required for any non-trivial iframe embedding (analytics dashboards, OAuth flows, payment widgets). `allow-same-origin` is intentionally excluded from the default to prevent third-party front components from accessing the host application's cookies/storage, maintaining the security boundary. 2. **Reversed the spread order from `{...filterProps(props), ...forcedProps}` to `{...defaultProps, ...filterProps(props)}`** — Previously, forced props were spread last, silently overriding any developer-supplied `sandbox` attribute. Now default props are spread first, so app developers can explicitly set their own sandbox value when needed (e.g., `sandbox="allow-scripts allow-same-origin"` for trusted same-origin content). This follows the standard React "defaults with overrides" pattern. The constant was renamed from `FORCED_PROPS_BY_TAG` to `DEFAULT_PROPS_BY_TAG` and the local variable from `forcedProps` to `defaultProps` to accurately reflect the new semantics. |
||
|---|---|---|
| .. | ||
| create-twenty-app | ||
| twenty-apps | ||
| twenty-cli | ||
| twenty-client-sdk | ||
| twenty-companion | ||
| twenty-docker | ||
| twenty-docs | ||
| twenty-e2e-testing | ||
| twenty-emails | ||
| twenty-front | ||
| twenty-front-component-renderer | ||
| twenty-oxlint-rules | ||
| twenty-sdk | ||
| twenty-server | ||
| twenty-shared | ||
| twenty-ui | ||
| twenty-utils | ||
| twenty-website | ||
| twenty-website-new | ||
| twenty-zapier | ||