IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Sandbox: Redirect calls to window.location to window.locationSandbox (#72252)

Browse Source
This commit is contained in:
Esteban Beltran
2023-07-28 14:04:23 +02:00
committed by GitHub
parent f0912e3d62
commit 81a940f675
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
public/app/features/plugins/sandbox/code_loader.ts
View File

@@ -58,10 +58,15 @@ export async function getPluginCode(meta: PluginMeta): Promise<string> {
const response = await fetch('public/' + meta.module + '.js'); const response = await fetch('public/' + meta.module + '.js');
let pluginCode = await response.text(); let pluginCode = await response.text();
pluginCode = patchPluginSourceMap(meta, pluginCode); pluginCode = patchPluginSourceMap(meta, pluginCode);
pluginCode = patchPluginAPIs(pluginCode);
return pluginCode; return pluginCode;
} }
} }
function patchPluginAPIs(pluginCode: string): string {
return pluginCode.replace(/window\.location/gi, 'window.locationSandbox');
}
/** /**
* Patches the plugin's module.js source code references to sourcemaps to include the full url * Patches the plugin's module.js source code references to sourcemaps to include the full url
* of the module.js file instead of the regular relative reference. * of the module.js file instead of the regular relative reference.

5
public/app/features/plugins/sandbox/sandbox_plugin_loader.ts
View File

@@ -74,6 +74,11 @@ async function doImportPluginModuleInSandbox(meta: PluginMeta): Promise<unknown>
liveTargetCallback: isLiveTarget, liveTargetCallback: isLiveTarget,
// endowments are custom variables we make available to plugins in their window object // endowments are custom variables we make available to plugins in their window object
endowments: Object.getOwnPropertyDescriptors({ endowments: Object.getOwnPropertyDescriptors({
// window.location is unforgeable, we make the location available via endowments
// when the plugin code is loaded, the sandbox replaces the window.location with
// window.locationSandbox. In the future `window.location` could be a proxy if we
// want to intercept calls to it.
locationSandbox: window.location,
// Plugins builds use the AMD module system. Their code consists // Plugins builds use the AMD module system. Their code consists
// of a single function call to `define()` that internally contains all the plugin code. // of a single function call to `define()` that internally contains all the plugin code.
// This is that `define` function the plugin will call. // This is that `define` function the plugin will call.