grist-widget-sdk 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # grist-widget-sdk
 
+## 0.6.1
+
+### Patch Changes
+
+- 71785f8: **Attachment URLs only take an attachment id.** `getAttachmentUrl()`, `fetchAttachmentBlob()` (and the helpers behind them) now refuse anything but a positive integer as the attachment id, before asking Grist for an access token: the id usually comes from a cell, and the URL built from it carries the document's token, so a crafted value (`"1/../tables"`) could otherwise aim it at another route of the same Grist. The token in the URL is now encoded too.
+  
+  `grist-widget-sdk` no longer depends on `grain-rpc`, which nothing imported since the iframe transport was removed: one package fewer in every widget.
+
 ## 0.6.0
 
 ### Minor Changes

package/dist/app.cjs

@@ -365,8 +365,12 @@ async function getAttachmentDownloadUrl(docApi, attachmentId, options) {
   if (!getAccessToken) {
     throw new Error("getAccessToken is not available on docApi");
   }
+  const id = String(attachmentId).trim();
+  if (!/^[1-9]\d*$/.test(id)) {
+    throw new Error(`getAttachmentDownloadUrl: "${attachmentId}" is not an attachment id (a positive integer).`);
+  }
   const { token: token2, baseUrl } = await getAccessToken({ readOnly: options?.readOnly ?? false });
-  return `${baseUrl}/attachments/${attachmentId}/download?auth=${token2}`;
+  return `${baseUrl}/attachments/${id}/download?auth=${encodeURIComponent(token2)}`;
 }
 async function fetchBytesFromSignedAttachmentUrl(url) {
   const response = await fetch(url);