Loading workspace insights... Statistics interval
7 days30 daysLatest CI Pipeline Executions
d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> bfaef841 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 95c6a948 Fix origin validation bypass in postMessage trust checks (#4724)
## Description
Fixes a security issue reported by a customer where `postMessage`
origin/referrer validation could be bypassed using spoofed or lookalike
hostnames, potentially allowing untrusted windows to send messages
(including block bindings that get executed as code) to Builder-rendered
pages.
Specifically:
- **`packages/core/src/builder.class.ts`**:
`Builder.isTrustedHostForEvent` previously parsed the origin without
strictly validating the protocol/format, and `Builder.isEditing` used an
unanchored regex (`/builder\.io|localhost:1234/`) against
`document.referrer`, which would match spoofed hostnames like
`evil-builder.io.attacker.com` or `notlocalhost:1234x`. This has been
fixed by:
- Requiring the origin to match `^https?:\/\//i` before parsing.
- Validating the parsed protocol is `http:`/`https:` and the hostname is
trusted via `Builder.isTrustedHost`.
- Replacing the unanchored regex check in `isEditing` with a call to
`Builder.isTrustedHostForEvent`, reusing the same validated logic.
- **`packages/react/src/components/builder-block.component.tsx`**:
`BuilderBlock.onWindowMessage` did not validate the message origin at
all, unlike `BuilderContent.onWindowMessage`. Added an origin check
using `Builder.isTrustedHostForEvent(event)` at the top of the handler,
returning early if the origin isn't trusted, matching the existing
pattern used by `BuilderContent`.
- **`packages/sdks/src/functions/is-from-trusted-host.ts`**:
`isFromTrustedHost` used `startsWith('http')`/`startsWith('https')`
checks and did not guard against malformed URLs throwing during `new
URL(...)`. Updated to safely parse the URL in a try/catch, return
`false` on parse failure, and explicitly validate the protocol is
`http:` or `https:` before checking the hostname against the trusted
hosts list. This applies the same fix to the Gen2 SDKs.
### Tests
- Added/updated tests in `packages/core/src/builder.class.test.ts`,
`packages/react/test/builder-block.test.tsx` (new), and
`packages/sdks/src/functions/is-from-trusted-host.test.ts` covering
spoofed hostnames (e.g. `evil-builder.io.attacker.com`,
`notlocalhost:1234x`), non-HTTP origins (e.g.
`javascript://builder.io`), the literal string `"null"`, and non-URL
strings — asserting these are all correctly rejected as untrusted.
**JIRA**
https://builder-io.atlassian.net/browse/ENG-13357
---
<a
href="https://builder.io/app/projects/b29d4bc79bfe480fb3f0/classic-seed-fvi4jqvb"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2F226fa21c49ce4f95a5aba53aa594fe7a"><img
src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2F949e3db6dedf4252bf6ae0258f4a37de"
alt="Edit in Builder"></picture></a> <a
href="https://b29d4bc79bfe480fb3f0-classic-seed-fvi4jqvb.projects.builder.my/"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2Fe530b1333b5b4cedac9c41b8573c8268"><img
src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2Fbf5aebbec0b448779c805d58bacf6278"
alt="Preview"></picture></a>
---
To clone this PR locally use the [Github CLI](https://cli.github.com/)
with command `gh pr checkout 4724`
You can tag me at @builderio for anything you want me to fix or change
<!-- DO NOT EDIT THE CONTENT BELOW: -->
<!--<projectId>b29d4bc79bfe480fb3f0</projectId>-->
<!--<branchName>classic-seed-fvi4jqvb</branchName>-->
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **High Risk**
> Security fix for editor postMessage handling and code-binding updates;
incorrect validation could break legitimate editing or leave XSS vectors
open.
>
> **Overview**
> Closes a **postMessage origin bypass** where spoofed hostnames or
malformed origins could be treated as trusted, allowing untrusted pages
to send editor messages (including `builder.patchUpdates` that apply
bindings executed as code).
>
> **`Builder.isTrustedHostForEvent`** now requires `^https?://`, parses
the origin in a try/catch, enforces `http:`/`https:` protocol, and
checks the hostname with **`Builder.isTrustedHost`** (exact match, not
substring). **`Builder.isEditing`** drops the unanchored
`/builder\.io|localhost:1234/` referrer regex in favor of the same
helper.
>
> **`BuilderBlock.onWindowMessage`** adds an early
**`isTrustedHostForEvent`** guard (aligned with other editor listeners).
Gen2 **`isFromTrustedHost`** mirrors the same parse/protocol/hostname
rules.
>
> Tests cover lookalike domains, non-HTTP schemes, and invalid origins;
a changeset patches all affected SDK packages.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
e7f5de7509ad1c674bbb0279c1e95257d2cf64d9. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Builder.io <builder-bot@builder.io>