Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
sanity-plugin-iframe-pane
Advanced tools
Display any URL in a View Pane, along with helpful buttons to Copy the URL or open in a new tab
This is a Sanity Studio v3 plugin. For the v2 version, please refer to the v2-branch.
Display any URL in a View Pane, along with helpful buttons to Copy the URL or open it in a new tab.
Accepts either a string or an async function to resolve a URL based on the current document.
npm install --save sanity-plugin-iframe-pane
or
yarn add sanity-plugin-iframe-pane
This is designed to be used as a Component inside of a View.
The simplest way to configure views is by customizing the defaultDocumentNode
setting in the deskTool()
plugin.
// ./sanity.config.ts
export default defineConfig({
// ...other config settings
plugins: [
deskTool({
defaultDocumentNode,
structure, // not required
}),
// ...other plugins
],
})
A basic example of a custom defaultDocumentNode
function, to only show the Iframe Pane on movie
type documents.
// ./src/defaultDocumentNode.ts
import {DefaultDocumentNodeResolver} from 'sanity/desk'
import {Iframe} from 'sanity-plugin-iframe-pane'
import {SanityDocument} from 'sanity'
// Customise this function to show the correct URL based on the current document
function getPreviewUrl(doc: SanityDocument) {
return doc?.slug?.current
? `${window.location.host}/${doc.slug.current}`
: `${window.location.host}`
}
// Import this into the deskTool() plugin
export const defaultDocumentNode: DefaultDocumentNodeResolver = (S, {schemaType}) => {
// Only show preview pane on `movie` schema type documents
switch (schemaType) {
case `movie`:
return S.document().views([
S.view.form(),
S.view
.component(Iframe)
.options({
url: (doc: SanityDocument) => getPreviewUrl(doc),
})
.title('Preview'),
])
default:
return S.document().views([S.view.form()])
}
}
// Required: Accepts an async function
url: (doc) => resolveProductionUrl(doc),
// OR a string
url: `https://sanity.io`,
// OR a configuration for usage with `@sanity/preview-url-secret` and Next.js Draft Mode
url: {
origin: 'https://sanity.io' // or 'same-origin' if the app and studio are on the same origin
preview: (document) => document?.slug?.current ? `/posts/${document.slug.current}` : new Error('Missing slug'),
draftMode: '/api/draft' // the route you enable draft mode, see: https://github.com/sanity-io/visual-editing/tree/main/packages/preview-url-secret#sanitypreview-url-secret
},
// Optional: Display the Url in the pane
showDisplayUrl: true // boolean. default `true`.
// Optional: Set the default size
defaultSize: `mobile`, // default `desktop`
// Optional: Add a reload button
reload: {
button: true, // default `undefined`
},
// Optional: Pass attributes to the underlying `iframe` element:
// See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe
attributes: {
allow: 'fullscreen', // string, optional
referrerPolicy: 'strict-origin-when-cross-origin', // string, optional
sandbox: 'allow-same-origin', // string, optional
}
MIT-licensed. See LICENSE.
This plugin uses @sanity/plugin-kit with default configuration for build & watch scripts.
See Testing a plugin in Sanity Studio on how to run this plugin with hotreload in the studio.
Run "CI & Release" workflow.
Make sure to select the main
branch and check "Release new version".
Semantic release will only release on configured branches, so it is safe to run release on any branch.
FAQs
Display any URL in a View Pane, along with helpful buttons to Copy the URL or open in a new tab
We found that sanity-plugin-iframe-pane demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.