CVE-2026-47068

@@ -11,17 +11,22 @@ defmodule PhoenixStorybook.Story.ComponentIframeLive do
   alias PhoenixStorybook.StoryNotFound
   alias PhoenixStorybook.ThemeHelpers
 
+  @playground_topic_salt "phoenix_storybook:playground_topic"
+  @playground_token_max_age 86_400
+
   def mount(_params, _session, socket) do
     {:ok, assign(socket, []), layout: {PhoenixStorybook.LayoutView, :live_iframe}}
   end
 
   def handle_params(params = %{"story" => story_path}, _uri, socket) do
     case load_story(socket, story_path) do
       {:ok, story} ->
-        if params["topic"] do
+        topic = verified_playground_topic(socket, params["playground_token"])
+
+        if topic do
           PubSub.broadcast!(
             PhoenixStorybook.PubSub,
-            params["topic"],
+            topic,
             {:component_iframe_pid, self()}
           )
         end
@@ -36,7 +41,7 @@ defmodule PhoenixStorybook.Story.ComponentIframeLive do
            story: story,
            variation_id: params["variation_id"],
            variation: current_variation(story.storybook_type(), story, params),
-           topic: params["topic"],
+           topic: topic,
            theme: params["theme"],
            color_mode: params["color_mode"]
          )
@@ -51,6 +56,17 @@ defmodule PhoenixStorybook.Story.ComponentIframeLive do
     end
   end
 
+  defp verified_playground_topic(_socket, nil), do: nil
+
+  defp verified_playground_topic(socket, token) do
+    case Phoenix.Token.verify(socket.endpoint, @playground_topic_salt, token,
+           max_age: @playground_token_max_age
+         ) do
+      {:ok, %{"topic" => topic}} when is_binary(topic) -> topic
+      _other -> nil
+    end
+  end
+
   defp load_story(socket, story_param) do
     story_path = Path.join(story_param)
     socket.assigns.backend_module.load_story(story_path)

@@ -24,8 +24,14 @@ defmodule PhoenixStorybook.StoryLive do
 
   import PhoenixStorybook.NavigationHelpers
 
+  @playground_topic_salt "phoenix_storybook:playground_topic"
+
   def mount(_params, _session, socket) do
     playground_topic = "playground-#{inspect(self())}"
+
+    playground_token =
+      Phoenix.Token.sign(socket.endpoint, @playground_topic_salt, %{"topic" => playground_topic})
+
     event_logs_topic = "event_logs:#{inspect(self())}"
 
     if connected?(socket) do
@@ -41,6 +47,7 @@ defmodule PhoenixStorybook.StoryLive do
        playground_error: nil,
        playground_preview_pid: nil,
        playground_topic: playground_topic,
+       playground_token: playground_token,
        fa_plan: backend_module.config(:font_awesome_plan, :free),
        selected_color_mode: get_selected_color_mode(socket),
        color_mode: get_color_mode(socket)
@@ -429,6 +436,7 @@ defmodule PhoenixStorybook.StoryLive do
       theme={@theme}
       color_mode={@color_mode}
       topic={@playground_topic}
+      playground_token={@playground_token}
       fa_plan={@fa_plan}
       root_path={@root_path}
     />

@@ -316,7 +316,7 @@ defmodule PhoenixStorybook.Story.Playground do
                 theme: to_string(@theme),
                 color_mode: to_string(@color_mode),
                 playground: true,
-                topic: @topic
+                playground_token: @playground_token
               )
             }
             height="128"

@@ -8,6 +8,7 @@ defmodule PhoenixStorybook.ComponentIframeLiveTest do
   alias PhoenixStorybook.Story.ComponentIframeLive
 
   @endpoint PhoenixStorybook.ComponentIframeLiveEndpoint
+  @playground_topic_salt "phoenix_storybook:playground_topic"
   @moduletag :capture_log
 
   defmodule BackendNoTheme do
@@ -194,7 +195,7 @@ defmodule PhoenixStorybook.ComponentIframeLiveTest do
     end
   end
 
-  test "broadcasts iframe pid when topic is provided", %{conn: conn} do
+  test "does not broadcast iframe pid when raw topic is provided", %{conn: conn} do
     topic = "psb-component-iframe-#{System.unique_integer([:positive])}"
     Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, topic)
 
@@ -204,10 +205,37 @@ defmodule PhoenixStorybook.ComponentIframeLiveTest do
         "topic" => topic
       })
 
+    refute_receive {:component_iframe_pid, _pid}, 50
+  end
+
+  test "broadcasts iframe pid when valid playground token is provided", %{conn: conn} do
+    topic = "psb-component-iframe-#{System.unique_integer([:positive])}"
+    token = Phoenix.Token.sign(@endpoint, @playground_topic_salt, %{"topic" => topic})
+    Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, topic)
+
+    {:ok, _view, _html} =
+      live_with_params(conn, "/storybook/iframe/component", %{
+        "variation_id" => "hello",
+        "playground_token" => token
+      })
+
     assert_receive {:component_iframe_pid, pid}
     assert is_pid(pid)
   end
 
+  test "does not broadcast iframe pid when playground token is invalid", %{conn: conn} do
+    topic = "psb-component-iframe-#{System.unique_integer([:positive])}"
+    Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, topic)
+
+    {:ok, _view, _html} =
+      live_with_params(conn, "/storybook/iframe/component", %{
+        "variation_id" => "hello",
+        "playground_token" => "bad-token"
+      })
+
+    refute_receive {:component_iframe_pid, _pid}, 50
+  end
+
   test "handle_params raises StoryNotFound for not_found backend" do
     socket = base_socket(BackendNotFound)
 

@@ -130,8 +130,21 @@ defmodule PhoenixStorybook.PlaygroundLiveTest do
 
   describe "component in an iframe" do
     test "renders the playground preview iframe", %{conn: conn} do
-      {:ok, _view, html} = live(conn, "/storybook/live_component?tab=playground")
+      {:ok, view, html} = live(conn, "/storybook/live_component?tab=playground")
       assert html =~ ~S|<iframe id="tree_storybook_live_component-playground-preview"|
+
+      [src] =
+        view
+        |> element("#tree_storybook_live_component-playground-preview")
+        |> render()
+        |> LazyHTML.from_fragment()
+        |> LazyHTML.attribute("src")
+
+      query = src |> URI.parse() |> Map.fetch!(:query) |> URI.decode_query()
+
+      assert Map.has_key?(query, "playground_token")
+      refute Map.has_key?(query, "topic")
+      refute src =~ "topic=playground-"
     end
   end