dumi 2.4.54 → 2.4.55

package/dist/client/pages/Demo/index.js

@@ -1,5 +1,6 @@
 import { useDemo, useLiveDemo, useLocation, useParams } from 'dumi';
 import { createElement, useEffect } from 'react';
+import { isLiveDemoMessage, isLiveDemoSource } from "../../theme-api/liveDemoMessage";
 import { useRenderer } from "../../theme-api/useRenderer";
 import "./index.less";
 var DemoRenderPage = function DemoRenderPage() {
@@ -29,8 +30,13 @@ var DemoRenderPage = function DemoRenderPage() {
 
   // listen message event for setSource
   useEffect(function () {
+    var _demo$asset;
+    var dependencies = (_demo$asset = demo.asset) === null || _demo$asset === void 0 ? void 0 : _demo$asset.dependencies;
+    var entryFileName = dependencies && Object.keys(dependencies).find(function (key) {
+      return dependencies[key].type === 'FILE';
+    });
     var handler = function handler(ev) {
-      if (ev.data.type === 'dumi.liveDemo.setSource') {
+      if (isLiveDemoMessage(ev, window.parent, 'dumi.liveDemo.setSource') && isLiveDemoSource(ev.data.value, entryFileName)) {
         setSource(ev.data.value);
       }
     };
@@ -38,9 +44,9 @@ var DemoRenderPage = function DemoRenderPage() {
     return function () {
       return window.removeEventListener('message', handler);
     };
-  }, [setSource]);
+  }, [demo.asset, setSource]);
 
-  // notify parent window that compile done
+  // The parent listens on this window for compilation completion.
   useEffect(function () {
     if (!loading && (liveDemoError || liveDemoNode)) {
       window.postMessage({
@@ -48,7 +54,7 @@ var DemoRenderPage = function DemoRenderPage() {
         value: {
           err: liveDemoError
         }
-      });
+      }, window.location.origin);
     }
   }, [liveDemoError, liveDemoNode, loading]);
   return finalNode;

package/dist/client/theme-api/liveDemoMessage.d.ts

@@ -0,0 +1,4 @@
+/** Only trust messages from the expected window on this site's origin. */
+export declare function isLiveDemoMessage(event: MessageEvent, source: Window, type: 'dumi.liveDemo.setSource' | 'dumi.liveDemo.compileDone'): boolean;
+export declare function isLiveDemoSource(value: unknown, entryFileName: string | undefined): value is Record<string, string>;
+export declare function isLiveDemoCompileResult(value: unknown): boolean;

package/dist/client/theme-api/liveDemoMessage.js

@@ -0,0 +1,19 @@
+function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
+function isRecord(value) {
+  return _typeof(value) === 'object' && value !== null && !Array.isArray(value);
+}
+
+/** Only trust messages from the expected window on this site's origin. */
+export function isLiveDemoMessage(event, source, type) {
+  var origin = window.location.origin;
+  return origin !== 'null' && event.origin === origin && event.source === source && isRecord(event.data) && event.data.type === type;
+}
+export function isLiveDemoSource(value, entryFileName) {
+  return isRecord(value) && entryFileName !== undefined && Object.prototype.hasOwnProperty.call(value, entryFileName) && typeof value[entryFileName] === 'string' && Object.values(value).every(function (source) {
+    return typeof source === 'string';
+  });
+}
+export function isLiveDemoCompileResult(value) {
+  // Preserve arbitrary compiler throw values, including errors from other realms.
+  return isRecord(value) && Object.prototype.hasOwnProperty.call(value, 'err');
+}

package/dist/client/theme-api/useLiveDemo.js

@@ -13,6 +13,7 @@ import { useDemo } from 'dumi';
 import throttle from 'lodash.throttle';
 import { createElement, useCallback, useRef, useState } from 'react';
 import DemoErrorBoundary from "./DumiDemo/DemoErrorBoundary";
+import { isLiveDemoCompileResult, isLiveDemoMessage } from "./liveDemoMessage";
 import { useRenderer } from "./useRenderer";
 import { getAgnosticComponentModule } from "./utils";
 var THROTTLE_WAIT = 500;
@@ -76,7 +77,7 @@ export var useLiveDemo = function useLiveDemo(id, opts) {
             _context.next = 5;
             return new Promise(function (resolve) {
               var handler = function handler(ev) {
-                if (ev.data.type.startsWith('dumi.liveDemo.compileDone')) {
+                if (isLiveDemoMessage(ev, iframeWindow, 'dumi.liveDemo.compileDone') && isLiveDemoCompileResult(ev.data.value)) {
                   iframeWindow.removeEventListener('message', handler);
                   setError(ev.data.value.err);
                   resolve();
@@ -86,7 +87,7 @@ export var useLiveDemo = function useLiveDemo(id, opts) {
               iframeWindow.postMessage({
                 type: 'dumi.liveDemo.setSource',
                 value: source
-              });
+              }, window.location.origin);
             });
           case 5:
             _context.next = 74;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dumi",
-  "version": "2.4.54",
+  "version": "2.4.55",
   "description": "📖 Documentation Generator of React Component",
   "keywords": [
     "generator",
@@ -157,6 +157,7 @@
     "git-repo-info": "^2.1.1",
     "highlight-words-core": "^1.2.2",
     "husky": "^8.0.3",
+    "jsdom": "^26.1.0",
     "lint-staged": "^13.2.3",
     "prettier": "^2.8.8",
     "prettier-plugin-organize-imports": "^3.2.3",