elemental_styleguide
elemental_styleguide copied to clipboard
Figure out a better, more secure way of injecting examples into the example iframe
Currently examples are Base64 encoded, then passed to the iframe which, as part of the examples_controller#show
method, decodes it and evaluates the erb
. This is obviously not a good idea, since anyone with access to the style guide can execute any erb
they want. That is why the style guide should currently not be used in a production environment, and is considered experimental.
So, we should figure out a better way to pass and evaluate the erb
to the iframe.