GrapesJS code is open to XSS issues because values are inserted into DOM without escaping, e.g. https://github.com/artf/grapesjs/blob/dev/src/assetmanager/view/AssetImageView.js#L30 If model.getFilename() returns <img src=x onerror=alert(document.cookie)>.jpg, this can result in an account takeover. Instead the code s...
aimeos
@artf What are your plans because the vulnerability of GrapesJS to XSS is a pretty big security problem
artf
Yeah thanks for the report @aimeos I'll fix it in the next version for sure
aimeos
@artf The documentation also uses ${var} to insert variables into templates often. This should also be changed to avoid that developers introduce security issues too without knowing that.
Version: 0.17.19 Are you able to reproduce the bug from the demo? No, because its full screen and there is no parent container scroll. What is the expected behavior? Hover state cadre to see the component changes position Describe the bug detailed When I want to select or hover on specific component, it shows wrong po...
artf
If the scrollable element is not the editor's parent node, you might need this option https://github.com/artf/grapesjs/blob/dc45604962e4e6a4a075f19d5de67090bac15fa5/src/editor/config/config.js#L157-L163
no-response[bot]
This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take ac...
GJSBlock
Thanks for reporting this, @maxtsh. The issue with Hover on component when parent of editor scrolls, show wrong positioning appears to be a race condition or state management timing problem. This typically happens when component lifecycle...
Hello. Is there possibility to create grapesjs instance, without generating whole editor? I had created custom components with async data and I need to create backend service in Node, which generates HTML output from stored components, populated with data from APIs. Now I am getting error:ReferenceError: window is not...
artf
I close it as a duplicate of https://github.com/artf/grapesjs/issues/3399
GJSBlock
Thanks for reporting this, @milan-holes. The error error:ReferenceError: window is not defined occurs when Components attempts to access properties before the component lifecycle is fully initialized. This is a common race condition in Gra...
Version: 0.17.4 Are you able to reproduce the bug from the demo?[x] Yes[ ] No Steps to reproduce:Go to the demoDrop a "Text" block inside the canvasClick on the "Text" component that was just droppedThe opened RTE is misplaced (cf attached screenshot) What is the expected behavior? The opened RTE should be positioned...
artf
Yes, I guess you're right. It doesn't actually make sense activating RTE without selecting the component (it probably makes sense with all other "activatable" blocks).
gustavohleal
Hi. Me and @ronaldohoch have found a workaround for this problem. We trigger the scroll event when the RTE is enabled. Here's the code:
ronaldohoch
Hello, just updated the file from commit bb4a661, and i think it's so close, i'm using the grapesjs-ckeditor code and the first open of RTE, i'ts placed right: But at the second time the rte is open, it's misplaced again... :/ I'll keep ch...
I got this error when add the <iframe src="https://app.conversiobot.com/boot/fvMEvO" width="100%" height="500" frameBorder="0" allow="geolocation"></iframe> used the custom code component. my code works fine with 0.17.4, but got below error with 0.17.19 grapes.min.js:2 Uncaught TypeError: Cannot read property 'length'...
artf
Thanks for the report, the fix is ready for the next release.
rahul-singh-bv
I am encountering a similar issue with v0.19.5 when I try to add an iframe inside of a custom code block
GJSBlock
Thanks for reporting this, @jcsofts. The error TypeError: Cannot read property 'length' of undefined occurs when Canvas attempts to access properties before the component lifecycle is fully initialized. This is a common race condition in G...
Version: 0.17.17 Are you able to reproduce the bug from the demo?[ ] Yes[x] No What is the expected behavior? It shouldn't show duplicate controls. What is the current behavior? Describe the bug detailed For some reasons, i am getting duplicate controls with vanila setup of gjs. Are you able to attach screenshots, scr...
artf
Add this to your init config in order to remove the default properties styleManager: { clearProperties: 1 },
GJSBlock
Thanks for reporting this, @jasminder. The issue with Duplicate controls for every component appears to be a race condition or state management timing problem. This typically happens when component lifecycle events and DOM modifications ov...
0.17.19 Are you able to reproduce the bug from the demo? YES What is the expected behavior? I had asked a question regarding iframe refresh (#3413). The proposed solution was working for that version (0.17.3) and after running the piece of code the iframe should refresh and the canvas should be seen with the component...
artf
I would need to check why he is still trying to remove the frame, but for now, just skip this line frameView.remove()
theSC0RP
@artf. Thanks. This works when done once. If I do some action like a click inside the canvas and then if I run frameWrapView.render(); once again, I got another error. The screenshot and a video of this error are attached below. <hr> https...
artf
I'll try to fix it in the next release, but for now, you have to unselect components before frameWrapView.render() and reselect them back post rendering
Version: 0.17.4 / git master Describe the bug detailed FrameView repackages keyboard and mouse events here: https://github.com/artf/grapesjs/blob/07061ae1307fedf2a3b9bd585ce0cb30f653f112/src/canvas/view/FrameView.js#L389-L399 I think the reason is related to redirecting iframe events to parent frame events. This would...
GJSBlock
Thanks for reporting this, @anlumo. The issue with createCustomEvent Doesn't Handle Mouse Events Correctly appears to be a race condition or state management timing problem. This typically happens when component lifecycle events and DOM mo...
Version: 0.17.4 Are you able to reproduce the bug from the demo? YES What is the expected behavior? When dragging the blocks, the order should be preserved. What is the current behavior? When dragging to the top or above the set of blocks, it goes in one order. When dragging to the bottom or below the set of blocks, i...
lexoyo
Hello I'm trying to fix this bug This is more of an exercise for me to dive in grapesjs code, let me know if I'm loosing my time or if it sounds useful
GJSBlock
Thanks for reporting this, @japo32. The issue with Dragging multiple blocks reverses the order appears to be a race condition or state management timing problem. This typically happens when component lifecycle events and DOM modifications...
npm run build gives error @version 0.17.3../../lib/codemirror in ./src/editor/dist/grapes.min.js../css/css in ./src/editor/dist/grapes.min.js../javascript/javascript in ./src/editor/dist/grapes.min.js../xml/xml in ./src/editor/dist/grapes.min.js
artf
Give us more details about your build and the error
iabhiyaan
iabhiyaan
npm run build:css works fine. But npm run build gives those errors