Repository navigation
Conversation
The form always reported success, including when no script URL was configured, and it posted visitor text to a public Apps Script.
Stop passing GOOGLE_SCRIPT_URL into the site build and delete the script that appended visitor text to the Sheet.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The docs footer asked "Was this helpful?" and posted the page URL, vote, comment, and user agent to a public Google Apps Script. That script appended the values straight into a Google Sheet. A cell that starts with
=is a formula, so a visitor could store a formula in the Intersect sheet.The widget also showed success when the script URL was missing, so we cannot treat it as a working collection channel. This PR removes the widget, the script template, and the build secret wiring.
Related Issue
Related to the private GHSA on formula injection in the feedback Apps Script.
Type of Change
Changes Made
website/src/components/FeedbackWidgetand the doc-footer swizzle that mounted it.website/src/css/custom.css.website/google-apps-script.js.customFields.googleScriptUrland theGOOGLE_SCRIPT_URLenv var from the Pages deploy workflow.After merge, please:
GOOGLE_SCRIPT_URLActions secret.=and clear any that are not real feedback.Checklist
mainormasterbranch.