Skip to content

Conversation

@SameDesu123
Copy link
Contributor

@SameDesu123 SameDesu123 commented Oct 14, 2025

A follow-up to #1055.

PR Checklist

  • Have you checked if it works normally in all models? Ignore this if it doesn't use models.
  • Have you checked if it works normally in all web, local, and node hosted versions? If it doesn't, have you blocked it in those versions?
  • Have you added type definitions?

Description

Problem

The initial implementation of the plugin security warning in #1055 did not account for iframes created dynamically via JavaScript. This allowed certain plugins to bypass the security check.

Solution

This pull request enhances the detection mechanism to identify iframes created programmatically. This ensures that users are properly warned about all plugins that utilize external iframes, strengthening the security of the plugin system.

Key Changes

  • Enhanced Iframe Detection: Updated the detection logic to recognize dynamically created iframes.
  • Localization: The new warning for external iframes has been added to all supported languages.

UI example

external iframe warn
risuai-plugin-external-iframe-warn

@SameDesu123 SameDesu123 deleted the feature/iframe-plugin-warning branch November 20, 2025 13:19
@SameDesu123 SameDesu123 restored the feature/iframe-plugin-warning branch November 20, 2025 13:20
@SameDesu123 SameDesu123 reopened this Nov 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant