We allow fetching external data in CodeSamples into a MDX environment, so we have to be careful about preventing code execution.
Current checks:
- External data is inserted as a code block (via the AST, not direct string manipulation), so it is escaped.
Added two new layers of checks:
- Allow-list of organizations, currently set to Supabase-only
- Only allow immutable commit references
Add the ability to embed code samples from GitHub into tutorials, so we can have a single source of truth for the source code.
Introduces the <$CodeSample /> syntax, which is a special syntax and not a real React component (see the directives/README.md for why on earth I did it this way -- in this specific case, CodeHike adjusts the MDX syntax tree before it gets compiled, and we need to adjust it ourselves before CodeHike sees it, so we need to get down to the level of manipulating the AST in order to make this work with CodeHike).
Adjusted one of the example tutorials to use this new feature as a test.
Charis