This repository was archived by the owner on Aug 6, 2026. It is now read-only.
trunk-merge/pr-3645/b3878270-5d46-4a85-b017-236f0b9f9643 - #3685
Closed
trunk-io[bot] wants to merge 5 commits into
Closed
trunk-merge/pr-3645/b3878270-5d46-4a85-b017-236f0b9f9643#3685trunk-io[bot] wants to merge 5 commits into
trunk-io[bot] wants to merge 5 commits into
Conversation
Generated-By: PostHog Code Task-Id: 2734dc0c-3cac-44d9-bc73-c86e58685df1
… broker Address review findings on the open-external path: - New isSafePostHogUrl in @posthog/shared: only absolute https posthog.com (or subdomain) URLs may leave the canvas sandbox. Enforced in the Zod message schema (safe for every consumer by construction) and re-checked in the FreeformCanvas handler with the blocked URL logged. - Rate-limit successful opens host-side: canvas code can post open-external without a user gesture, so opens are throttled to one per second. - Rewrite the sandbox click interceptor as an exported, unit-tested resolveExternalAnchorUrl inlined into the bootstrap: reads the href attribute (fixes SVG anchors and relative hrefs resolving against the host base URL), matches _blank case-insensitively, brokers absolute URLs only, listens in capture phase (immune to stopPropagation) and defers the open a tick so a canvas preventDefault() is honored. - Replace source-string test assertions with behavioral tests, and cover the message path (allowlist, rejection, throttle) in FreeformCanvas. Generated-By: PostHog Code Task-Id: b3fd12d3-df9b-416d-a660-0dc12ad82803
Addresses the veria-ai review finding: canvas code could call ph.openExternal during module evaluation or an effect, opening URLs as soon as a viewer loads the canvas (including dashboard thumbnails, which render without any click). The host can't observe gestures inside the null-origin iframe, but a real link click moves focus into it, so the open-external handler now ignores requests while the canvas iframe is not the focused element. Combined with the PostHog-only allowlist and the per-second throttle, load-time auto-opens are dropped. Generated-By: PostHog Code Task-Id: b3fd12d3-df9b-416d-a660-0dc12ad82803
Generated-By: PostHog Code Task-Id: b3fd12d3-df9b-416d-a660-0dc12ad82803
|
React Doctor found no issues in the changed files. 🎉 Reviewed by React Doctor for commit |
trunk-io
Bot
deleted the
trunk-merge/pr-3645/b3878270-5d46-4a85-b017-236f0b9f9643
branch
July 22, 2026 10:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created and is being managed by Trunk Merge.
This pull request is based on the main branch at SHA 7f1dbba0c29cc3dc25291cfd4557d1409337fd86.
See more details here.
When CI completes, this pull request will be closed automatically.
Pull Requests Being Tested
This pull request is testing the changes from pull request 3645.