@izumisy/md-react-preview 0.1.0 → 0.1.1

package/README.md

@@ -1,5 +1,7 @@
 # @izumisy/md-react-preview
 
+[![npm](https://img.shields.io/npm/v/@izumisy/md-react-preview)](https://www.npmjs.com/package/@izumisy/md-react-preview)
+
 CLI and programmatic API for md-react-preview — a zero-config component previewer for React projects.
 
 Drop Markdown files into `docs/` with `` ```tsx preview `` fenced blocks and get a Vite-powered dev server with live component previews and syntax-highlighted source code.

package/app/src/preview-block.tsx

@@ -113,11 +113,17 @@ export function PreviewBlock({
   const initialColorScheme = useRef(colorScheme);
   useEffect(() => {
     if (colorScheme === initialColorScheme.current) return;
-    iframeRef.current?.contentWindow?.postMessage({ type: "mrp-theme", theme: colorScheme }, "*");
+    // Security: specify origin instead of "*" to restrict postMessage recipients
+    iframeRef.current?.contentWindow?.postMessage(
+      { type: "mrp-theme", theme: colorScheme },
+      window.location.origin,
+    );
   }, [colorScheme]);
 
   useEffect(() => {
     function onMessage(e: MessageEvent) {
+      // Security: validate postMessage origin to prevent cross-origin message spoofing
+      if (e.origin !== window.location.origin) return;
       if (e.data?.type === "mrp-resize" && e.data?.blockId === blockId) {
         setIframeHeight(e.data.height);
       }
@@ -198,6 +204,14 @@ export function PreviewBlock({
           >
             <ExternalLinkIcon />
           </a>
+          {/*
+            Security note: no sandbox attribute is set on this iframe.
+            Preview blocks are authored by trusted developers (markdown authors),
+            and adding sandbox="allow-scripts" alone would break ES module loading
+            (CORS) and postMessage origin checks. Adding both allow-scripts and
+            allow-same-origin together provides no real security benefit for
+            same-origin iframes.
+          */}
           <iframe
             ref={iframeRef}
             src={previewUrl}

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as runPreview, r as startDev, t as runBuild } from "./server-C2ZxWhHj.mjs";
+import { n as runPreview, r as startDev, t as runBuild } from "./server-CUf5QIH2.mjs";
 import { defineCommand, runMain } from "citty";
 import { loadConfig } from "c12";
 import fg from "fast-glob";

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as escapeJsString, c as DEFAULT_GLOB, i as createPreviewerViteConfig, l as defineConfig, n as runPreview, o as extractPreviewBlocks, r as startDev, s as hasPreviewBlocks, t as runBuild } from "./server-C2ZxWhHj.mjs";
+import { a as escapeJsString, c as DEFAULT_GLOB, i as createPreviewerViteConfig, l as defineConfig, n as runPreview, o as extractPreviewBlocks, r as startDev, s as hasPreviewBlocks, t as runBuild } from "./server-CUf5QIH2.mjs";
 export { DEFAULT_GLOB, createPreviewerViteConfig, defineConfig, escapeJsString, extractPreviewBlocks, hasPreviewBlocks, runBuild, runPreview, startDev };

package/dist/{server-C2ZxWhHj.mjs → server-CUf5QIH2.mjs}

@@ -33,7 +33,7 @@ function extractPreviewBlocks(source) {
 	return blocks;
 }
 function escapeJsString(s) {
-	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
 /**
 * Check whether a source string contains ` ```tsx preview ` blocks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izumisy/md-react-preview",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "md-react-preview — component previewer powered by MDX",
   "bin": {
     "mrp": "./dist/cli.mjs"
@@ -16,9 +16,17 @@
       "default": "./dist/index.mjs"
     }
   },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/IzumiSy/md-react-preview",
+    "directory": "packages/md-react-preview"
+  },
   "keywords": [],
-  "author": "",
-  "license": "ISC",
+  "author": "IzumiSy",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "@mdx-js/react": "^3.1.0",
     "@mdx-js/rollup": "^3.1.0",
@@ -35,7 +43,7 @@
     "remark-mdx-frontmatter": "^5.2.0",
     "shiki": "^4.0.2",
     "vite": "^6.3.5",
-    "@izumisy/vite-plugin-react-preview": "0.1.0"
+    "@izumisy/vite-plugin-react-preview": "0.1.1"
   },
   "devDependencies": {
     "@types/node": "^22",