From 23fd2512afecb8527ea10930922e649b162cfc9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?B=C3=A1rbara=20Celi?= <112641072+barbara-celi@users.noreply.github.com> Date: Fri, 27 Jun 2025 10:07:34 -0300 Subject: [PATCH 1/3] Create overview.md --- docs/localization/overview.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 docs/localization/overview.md diff --git a/docs/localization/overview.md b/docs/localization/overview.md new file mode 100644 index 0000000000..8c3a880b05 --- /dev/null +++ b/docs/localization/overview.md @@ -0,0 +1,35 @@ +--- +title:"FastStore Analyzer" +--- + +The FastStore Analyzer provides a secure and controlled environment for implementing extension points, ensuring that custom code and third-party extensions don’t affect the host application's performance, security, or integrity. + +To inspect your project’s code, the Analyzer navigates through each node of your code and captures all function calls made during execution. Once complete, the Analyzer applies its rules to identify violations or warnings based on predefined security and performance standards. + +## Analyzer rules + +The Analyzer works by following these rules: + +| Available rules | Description | +|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| DOM API Access Restrictions | Prevents unauthorized access to specific DOM APIs (example: `document`, `window`, `localStorage`) that could potentially lead to security vulnerabilities or interfere with the normal operation of the web application.

By restricting access to these APIs, the Analyzer ensures your code remains compliant with security best practices and minimizes risks related to direct manipulation of the Document Object Model (DOM). | +| [CSS Containment Analysis] | Traverses through the PostCSS Abstract Syntax Tree (AST) to detect usage of problematic selectors that can compromise the styling integrity of your application, such as `:root`, `:host`, and `:host-context`.

Such selectors can lead to global style leakage, impacting the look and feel of the entire application instead of being contained within a specific module or component. The Analyzer enforces proper containment practices to ensure that each module's styles don’t interfere with others. | +| Third-Party Script Loading Detection | Prevents loading of third-party scripts, such as `importScripts`, `eval`, and `new Function`.

By disallowing these methods of script loading, the Analyzer safeguards the application against vulnerabilities that can arise from executing arbitrary code or using insecure script loading patterns. | +| Core Element Modification Detection | Prevents any modification to essential core elements of the HTML document, such as `body`, `html`, and `head`.

Ensuring these elements remain unmodified avoids unintended side effects and supports a stable and predictable environment for the application. | + +## Guides in this section + + + + + From a48dd1edac2b8f029b1a554a3d05c47c75d3fa90 Mon Sep 17 00:00:00 2001 From: kaio-donadelli Date: Fri, 18 Jul 2025 16:30:54 -0300 Subject: [PATCH 2/3] Doc reviewed by localization. --- docs/localization/overview.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/localization/overview.md b/docs/localization/overview.md index 8c3a880b05..11da200a49 100644 --- a/docs/localization/overview.md +++ b/docs/localization/overview.md @@ -2,20 +2,20 @@ title:"FastStore Analyzer" --- -The FastStore Analyzer provides a secure and controlled environment for implementing extension points, ensuring that custom code and third-party extensions don’t affect the host application's performance, security, or integrity. +FastStore Analyzer provides a secure and controlled environment for implementing extension points, ensuring that custom code and third-party extensions don't affect the host application's performance, security, or integrity. -To inspect your project’s code, the Analyzer navigates through each node of your code and captures all function calls made during execution. Once complete, the Analyzer applies its rules to identify violations or warnings based on predefined security and performance standards. +To inspect your project’s code, the Analyzer navigates through each node of your code and captures all function calls made during execution. Once the analysis is complete, it applies predefined rules to detect violations or warning based on established security and performance standards. ## Analyzer rules -The Analyzer works by following these rules: +The Analyzer works by applying the following rules: | Available rules | Description | |-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| DOM API Access Restrictions | Prevents unauthorized access to specific DOM APIs (example: `document`, `window`, `localStorage`) that could potentially lead to security vulnerabilities or interfere with the normal operation of the web application.

By restricting access to these APIs, the Analyzer ensures your code remains compliant with security best practices and minimizes risks related to direct manipulation of the Document Object Model (DOM). | -| [CSS Containment Analysis] | Traverses through the PostCSS Abstract Syntax Tree (AST) to detect usage of problematic selectors that can compromise the styling integrity of your application, such as `:root`, `:host`, and `:host-context`.

Such selectors can lead to global style leakage, impacting the look and feel of the entire application instead of being contained within a specific module or component. The Analyzer enforces proper containment practices to ensure that each module's styles don’t interfere with others. | -| Third-Party Script Loading Detection | Prevents loading of third-party scripts, such as `importScripts`, `eval`, and `new Function`.

By disallowing these methods of script loading, the Analyzer safeguards the application against vulnerabilities that can arise from executing arbitrary code or using insecure script loading patterns. | -| Core Element Modification Detection | Prevents any modification to essential core elements of the HTML document, such as `body`, `html`, and `head`.

Ensuring these elements remain unmodified avoids unintended side effects and supports a stable and predictable environment for the application. | +| DOM API access restrictions | Prevents unauthorized access to specific DOM APIs (example: `document`, `window`, `localStorage`) that could potentially lead to security vulnerabilities or interfere with the normal operation of the web application.

By restricting access to these APIs, the Analyzer ensures your code remains compliant with security best practices and minimizes risks related to direct manipulation of the Document Object Model (DOM). | +| [CSS containment analysis] | Traverses through the PostCSS Abstract Syntax Tree (AST) to detect the use of problematic selectors that can compromise the styling integrity of your application, such as `:root`, `:host`, and `:host-context`.

These selectors can lead to global style leakage, impacting the look and feel of the entire application instead of being contained within a specific module or component. The Analyzer enforces proper containment practices to ensure that each module's styles don't interfere with those of others. | +| Third-party script loading detection | Prevents the loading of third-party scripts, such as `importScripts`, `eval`, and `new Function`.

By disallowing these methods of script loading, the Analyzer helps protect your application against vulnerabilities caused by executing arbitrary code or using insecure loading patterns. | +| Core element modification detection | Prevents any modification to essential core elements of the HTML document, such as `body`, `html`, and `head`.

Ensuring these elements remain unmodified avoids unintended side effects and supports a stable and predictable environment for the application. | ## Guides in this section From 781e55b612c80a456930cdc71247a8205bb6bcd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?B=C3=A1rbara=20Celi?= <112641072+barbara-celi@users.noreply.github.com> Date: Mon, 21 Jul 2025 11:03:33 -0300 Subject: [PATCH 3/3] chore/moving file to correct folder --- .../docs/faststore-platform/faststore-analyzer}/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename docs/{localization => faststore/docs/faststore-platform/faststore-analyzer}/overview.md (99%) diff --git a/docs/localization/overview.md b/docs/faststore/docs/faststore-platform/faststore-analyzer/overview.md similarity index 99% rename from docs/localization/overview.md rename to docs/faststore/docs/faststore-platform/faststore-analyzer/overview.md index 11da200a49..86f20d5007 100644 --- a/docs/localization/overview.md +++ b/docs/faststore/docs/faststore-platform/faststore-analyzer/overview.md @@ -1,5 +1,5 @@ --- -title:"FastStore Analyzer" +title: "FastStore Analyzer" --- FastStore Analyzer provides a secure and controlled environment for implementing extension points, ensuring that custom code and third-party extensions don't affect the host application's performance, security, or integrity.