Fix share link to use config code instead of current URL - #562
Conversation
The header's button cluster (Save…Theme toggle) had no shrink/scroll guard, so on narrow viewports the rightmost buttons — including the light/dark toggle — overflowed off-screen with no way to reach them. Made the cluster a shrink-safe, scrollable strip and dropped the Save button's text label below `sm` to reduce the common-case footprint. Also fixed the header's Share button: it copied the raw current page URL instead of building a proper share link, so shared configs never carried the override code. It now uses buildShareUrl() like the Export panel already does, and both share paths use a new getShareBaseUrl() so embedded hosts (e.g. the WP plugin, which persists overrides via REST instead of the URL hash) point the link at their public standalone configurator instead of a logged-in admin URL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QTPpAk2ynC74tuUAsVpYNf
|
Warning Review limit reached
Next review available in: 41 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces a ChangesEmbedded Share Base URL Support
Estimated code review effort: 2 (Simple) | ~15 minutes Sequence Diagram(s)sequenceDiagram
participant App
participant StudioHeader
participant persistence
participant Clipboard
App->>StudioHeader: pass overrides prop
StudioHeader->>persistence: getShareBaseUrl()
persistence-->>StudioHeader: configurator_url or undefined
StudioHeader->>StudioHeader: buildShareUrl(overrides, baseUrl)
StudioHeader->>Clipboard: copy share URL
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoFix share link to use config code instead of raw page URL
AI Description
Diagram
High-Level Assessment
Files changed (6)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@configurator/src/lib/persistence.ts`:
- Around line 189-202: getShareBaseUrl currently returns any non-empty
configurator_url, but buildShareUrl later requires an absolute URL and will fail
silently when StudioHeader.handleShare or ExportPanel.handleCopyLink catch the
error. Tighten getShareBaseUrl to validate the
wpBoot().pluginSettings.configurator_url value shape before returning it, only
allowing absolute URLs with a valid protocol/host and otherwise returning
undefined so the existing fallback path can be used. Use the getShareBaseUrl and
buildShareUrl flow as the place to fix this misconfiguration handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b4399162-b3ac-49ba-9112-cee6c1758831
📒 Files selected for processing (6)
configurator/src/App.svelteconfigurator/src/components/panels/ExportPanel.svelteconfigurator/src/components/shell/StudioHeader.svelteconfigurator/src/lib/persistence.tsconfigurator/src/vite-env.d.tsconfigurator/tests-components/header.test.js
Code Review by Qodo
Context used✅ Compliance rules (platform):
12 rules 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| export function getShareBaseUrl(): string | undefined { | ||
| const url = wpBoot()?.pluginSettings?.configurator_url; | ||
| return url && url.trim() !== "" ? url : undefined; | ||
| } |
There was a problem hiding this comment.
2. Unsafe url schemes copied 🐞 Bug ⛨ Security
configurator_url is accepted without protocol validation, so a host can supply javascript:/data:/other non-http(s) schemes that will be copied as a “share link”. This is primarily a misconfiguration/phishing footgun, since the app will faithfully propagate the unsafe scheme into the copied URL.
Agent Prompt
## Issue description
The host-controlled `pluginSettings.configurator_url` is not validated. If it contains a non-http(s) scheme (e.g. `javascript:`), the app will copy that scheme into the generated share link.
## Issue Context
Even though the app only copies the string to the clipboard, users may paste/open it, so it’s worth preventing obviously unsafe schemes.
## Fix Focus Areas
- configurator/src/lib/persistence.ts[189-201]
- configurator/src/lib/codec.ts[278-285]
## Recommended fix
- When parsing/normalizing the base URL (either in `getShareBaseUrl()` or `buildShareUrl()`), explicitly allow only `http:` and `https:` protocols.
- If the parsed protocol is not allowed (or parsing fails), return `undefined` / fall back to `window.location.href` so share links remain functional.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
There was a problem hiding this comment.
Fixed in d96eba6 — getShareBaseUrl() now allowlists only http:/https: schemes; a javascript:/data: value is rejected (warned + undefined) rather than propagated into a copied link.
Generated by Claude Code
getShareBaseUrl() returned pluginSettings.configurator_url verbatim, but buildShareUrl() feeds it to new URL(baseUrl), which throws on a relative or malformed value — and both share/copy handlers swallow the exception, so a misconfigured host would make "Copy link" silently do nothing. It also propagated any scheme, so a javascript:/data: value could be copied as a "share link". Now parse-and-validate the URL, require an http(s) scheme, and return undefined (with a warning) otherwise so buildShareUrl falls back to the current page URL. Addresses review feedback on #562. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QTPpAk2ynC74tuUAsVpYNf
2 participants
Summary
The share button now generates a proper shareable link using the current overrides as a config code, rather than copying the raw page URL. This is especially important for embedded hosts (like the WordPress plugin) where the current page is a logged-in admin screen, not something worth sharing.
Key Changes
handleShare()to callbuildShareUrl(overrides, getShareBaseUrl())instead of copyingwindow.location.hrefdirectlyoverridesprop to component signature and passed it through from App.svelteshrink-0to all buttons and dividers to prevent flex shrinking on narrow screenshidden sm:inline(icon always visible, text hidden on mobile)px-2 sm:px-3)handleCopyLink()to usebuildShareUrl(overrides, getShareBaseUrl())getShareBaseUrl()function that returns the host's public configurator URL when embedded (e.g., from WordPress plugin settings), orundefinedin standalone modeSlashedAppBootinterface to includepluginSettingswith optionalconfigurator_urlpluginSettingstype definition towindow.slashedApp#c=)Implementation Details
The fix ensures that:
buildShareUrl's fallback)https://claude.ai/code/session_01QTPpAk2ynC74tuUAsVpYNf
Summary by CodeRabbit
New Features
Bug Fixes