elemental_styleguide icon indicating copy to clipboard operation
elemental_styleguide copied to clipboard

Figure out a better, more secure way of injecting examples into the example iframe

Open jensljungblad opened this issue 6 years ago • 0 comments

Currently examples are Base64 encoded, then passed to the iframe which, as part of the examples_controller#show method, decodes it and evaluates the erb. This is obviously not a good idea, since anyone with access to the style guide can execute any erb they want. That is why the style guide should currently not be used in a production environment, and is considered experimental.

So, we should figure out a better way to pass and evaluate the erb to the iframe.

jensljungblad avatar Nov 14 '18 13:11 jensljungblad