enable page plugin contributions for public routes and enhance GTM plugin by ryota-yamada-jp · Pull Request #156 · emdash-cms/emdash

ryota-yamada-jp · 2026-04-03T02:33:00Z

What does this PR do?

This PR enables the Google Tag Manager (GTM) plugin to function correctly on public pages and adds the missing advanced configuration options for GTM.

1. Enable Page Plugin Contributions for Public Routes
Previously, the Astro middleware (onRequest in middleware.ts) bypassed EmDashRuntime initialization for unauthenticated public requests as a performance optimization. This inadvertently prevented trusted plugins from injecting scripts via the page:fragments and page:metadata hooks on public pages, effectively breaking plugins like Google Tag Manager that need to run for all visitors.

Removed the early return for public requests so getRuntime(config) is properly initialized.
Exposed collectPageMetadata and collectPageFragments methods on locals.emdash so Astro components like EmDashBodyStart can correctly render the injected HTML.
Added comprehensive unit tests in middleware.test.ts to ensure runtime initialization and method binding work as expected even without an active session.

2. GTM Plugin Enhancements

Added advanced options to customize the Data Layer Variable Name (defaults to dataLayer), GTM Script URL (defaults to https://www.googletagmanager.com/gtm.js), and GTM NoScript URL (defaults to https://www.googletagmanager.com/ns.html) to support Server-Side GTM (SGTM) setups.

Type of change

Checklist

I have read CONTRIBUTING.md
pnpm typecheck passes
pnpm --silent lint:json | jq '.diagnostics | length' returns 0
pnpm test passes (or targeted tests for my change)
pnpm format has been run
I have added/updated tests for my changes (if applicable)
New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...

AI-generated code disclosure

This PR includes AI-generated code

Screenshots / test output

**Test Output**
✓ tests/unit/astro/middleware.test.ts (1 test)
  ✓ EmDash Middleware (1)
    ✓ initializes runtime and attaches methods for all pages

changeset-bot · 2026-04-03T02:33:04Z

⚠️ No Changeset found

Latest commit: a68a9d8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-04-03T02:33:09Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

ryota-yamada-jp · 2026-04-03T13:02:48Z

I have read the CLA Document and I hereby sign the CLA

ryota-yamada-jp · 2026-04-03T13:07:27Z

recheck

ryota-yamada-jp · 2026-04-03T13:11:13Z

recheck

z-ryota-yamada · 2026-04-03T13:13:16Z

I have read the CLA Document and I hereby sign the CLA

ascorbic · 2026-04-11T09:16:17Z

Hey! #119 fixed the issue with hooks for anonymous visitors, so this will need some reworking.

ryota-yamada-jp · 2026-04-13T03:21:01Z

@ascorbic Okay! I will fix this. Please wait a moment.

…nto feat/plugin-gtm

ryota-yamada-jp · 2026-04-15T11:21:16Z

@ascorbic I did fix it!

github-actions · 2026-05-11T18:48:09Z

This PR has been inactive for 14 days. It will be closed automatically in 7 days if there is no further activity.

If you're still working on this, please push an update or leave a comment.

github-actions · 2026-05-11T20:10:16Z

PR template validation failed

Please fix the following issues by editing your PR description:

Feature PRs require a link to an approved Discussion (https://github.com/emdash-cms/emdash/discussions/categories/ideas). Open a Discussion first, get approval, then link it in the PR.

See CONTRIBUTING.md for the full contribution policy.

pkg-pr-new · 2026-05-11T20:11:55Z

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@156

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@156

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@156

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@156

emdash

npm i https://pkg.pr.new/emdash@156

create-emdash

npm i https://pkg.pr.new/create-emdash@156

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@156

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@156

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@156

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@156

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@156

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@156

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@156

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@156

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@156

commit: 05f4cb4

emdashbot

The PR description claims two changes: (1) middleware fixes to enable page:fragments/page:metadata for public routes, and (2) GTM plugin enhancements. The actual diff contains only a new @emdash-cms/plugin-google-tag-manager package. The middleware narrative is stale—the fixes described were already merged to main in a prior release (see packages/core/CHANGELOG.md line 713 and the current middleware.ts). Reviewers should ignore the description and evaluate only the new plugin.

The plugin is a reasonable addition, but the implementation introduces stored XSS vulnerabilities and has several convention gaps that need fixing before merge:

Unescaped user input in page:fragments. The hook interpolates KV values (gtmScriptUrl, gtmNoScriptUrl, dataLayerName, containerId) directly into JavaScript string literals and HTML attributes without escaping or validation. A single quote in a URL breaks the JS string; a double quote breaks the HTML attribute. The core renderFragment helper does not protect against this—for inline-script it only escapes </, and for html it returns the markup verbatim.
No input validation on the admin form. Arbitrary strings are persisted to KV. URLs should be validated as https:// and the container ID should match the GTM-XXXXXXX format.
Deprecated capability. The plugin uses "page:inject", which is in the deprecation window. New plugins should use "hooks.page-fragments:register".
Missing changeset. A new published package needs a changeset to trigger a release.
No tests. Other plugins in packages/plugins/ have unit/integration tests; this package has none.
Missing approved Discussion. Per AGENTS.md, feature PRs require a prior approved Discussion.

Sandboxed plugins currently have no Lingui integration path (none of the existing plugins localize Block Kit strings), so I’m not flagging the hardcoded English as a dedicated finding—it’s a systemic gap.

Once the XSS/validation issues are fixed, the capability is updated, tests are added, and a changeset is included, this plugin is good to merge.

emdashbot · 2026-05-31T06:08:25Z

+					code: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+'${gtmScriptUrl}?id='+i+dl;f.parentNode.insertBefore(j,f);
+})(window,document,'script','${dataLayerName}','${containerId}');`,


[needs fixing] The page:fragments hook interpolates user-controlled KV values (gtmScriptUrl, dataLayerName, containerId) into single-quoted JavaScript string literals without escaping. A single quote or backslash in any of these values breaks the string literal and allows arbitrary code execution on every public page. For example, a gtmScriptUrl of https://evil.com/x';alert(1);var x=' would execute alert(1). The core renderFragment helper only escapes </ sequences in inline scripts; it does not escape single quotes. The plugin must sanitize before interpolation—at minimum by escaping \ and ', or by segmenting the values safely, and ideally by validating against expected formats.

emdashbot · 2026-05-31T06:08:25Z

+				{
+					kind: "html",
+					placement: "body:start",
+					html: `<noscript><iframe src="${gtmNoScriptUrl}?id=${containerId}" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>`,


[needs fixing] The html fragment interpolates gtmNoScriptUrl and containerId directly into an <iframe src> attribute without HTML-escaping or URL-encoding. A double quote in either value breaks out of the src attribute and injects arbitrary HTML. An ampersand in containerId injects extra query parameters. The renderFragment helper returns html contributions verbatim, so the plugin must escape attribute metacharacters (" → ", & → &) and use encodeURIComponent for the query string.

emdashbot · 2026-05-31T06:08:26Z

+				if (interaction.type === "form_submit" && interaction.action_id === "save_gtm") {
+					const values = interaction.values || {};
+					await ctx.kv.set("settings:gtmContainerId", values.gtm_container_id || "");
+					await ctx.kv.set("settings:gtmDataLayerName", values.gtm_data_layer_name || "dataLayer");
+					await ctx.kv.set(
+						"settings:gtmScriptUrl",
+						values.gtm_script_url || "https://www.googletagmanager.com/gtm.js",
+					);
+					await ctx.kv.set(
+						"settings:gtmNoScriptUrl",
+						values.gtm_noscript_url || "https://www.googletagmanager.com/ns.html",
+					);


[needs fixing] The admin form submission handler stores arbitrary strings from interaction.values directly into KV without validation. gtm_script_url and gtm_noscript_url should be validated as HTTPS URLs (or at least valid URLs), and gtm_container_id should match the expected GTM-XXXXXXX format. Without validation, invalid or malicious input can break every public page or be exploited as stored XSS via the page:fragments hook.

emdashbot · 2026-05-31T06:08:26Z

+		format: "standard",
+		entrypoint: "@emdash-cms/plugin-google-tag-manager/sandbox",
+		options: {},
+		capabilities: ["page:inject"],


[needs fixing] The plugin declares the deprecated capability "page:inject". This name exists only in the deprecation window and is normalized to "hooks.page-fragments:register" at runtime. New plugins should use the current canonical capability name to avoid future breakage.

Suggested change

capabilities: ["page:inject"],

capabilities: ["hooks.page-fragments:register"],

emdashbot · 2026-05-31T06:08:26Z

+	],
+	"author": "Your Name",
+	"license": "MIT",
+	"dependencies": {},


[suggestion] The author field contains the placeholder value "Your Name". Update it to the actual author or remove the field.

Suggested change

"dependencies": {},

"author": "Ryota Yamada",

…nto feat/plugin-gtm

z-ryota-yamada added 4 commits April 3, 2026 08:54

add google tag manager plugin

ea71c1d

enable page plugin contributions for public routes

42ba0db

apply format

875bd81

delete unused-vars

7eb084f

ryota-yamada-jp changed the title ~~Feat/plugin gtm~~ enable page plugin contributions for public routes and enhance GTM plugin Apr 3, 2026

Merge branch 'main' into feat/plugin-gtm

0455a26

github-actions Bot added a commit that referenced this pull request Apr 3, 2026

@ryota-yamada-jp has signed the CLA in #156

17de3c1

github-actions Bot added a commit that referenced this pull request Apr 3, 2026

@z-ryota-yamada has signed the CLA in #156

849b8f0

github-actions Bot added the needs-approval label Apr 5, 2026

Merge branch 'main' into feat/plugin-gtm

3af9114

github-actions Bot added area/core area/plugins size/L cla: signed and removed needs-approval labels Apr 7, 2026

Merge branch 'main' into feat/plugin-gtm

3efac48

ascorbic added the Awaiting author response label Apr 11, 2026

github-actions Bot added the needs-rebase label Apr 12, 2026

z-ryota-yamada added 2 commits April 15, 2026 19:58

Merge remote-tracking branch 'origin' into feat/plugin-gtm

e0c1dbb

Merge branch 'feat/plugin-gtm' of github.com:ryota-yamada-jp/emdash i…

436640e

…nto feat/plugin-gtm

github-actions Bot removed the needs-rebase label Apr 15, 2026

ryota-yamada-jp marked this pull request as draft April 15, 2026 11:01

remote middleware test code

fc07fbf

github-actions Bot added size/M and removed size/L labels Apr 15, 2026

ryota-yamada-jp marked this pull request as ready for review April 15, 2026 11:20

ryota-yamada-jp and others added 3 commits April 19, 2026 18:29

Merge branch 'main' into feat/plugin-gtm

1d182e2

Merge branch 'main' into feat/plugin-gtm

7933182

Update lockfile

f146bd9

github-actions Bot added size/L and removed size/M labels Apr 27, 2026

Merge branch 'main' into feat/plugin-gtm

49d5ee1

github-actions Bot added the stale label May 11, 2026

Merge branch 'main' into feat/plugin-gtm

05f4cb4

github-actions Bot removed the stale label May 12, 2026

github-actions Bot added stale review/needs-review No maintainer or bot review yet and removed stale labels May 26, 2026

ascorbic added the bot:review Trigger an emdashbot code review on this PR label May 31, 2026

emdashbot Bot reviewed May 31, 2026

View reviewed changes

github-actions Bot added review/awaiting-author Reviewed; waiting on the author to respond and removed review/needs-review No maintainer or bot review yet labels May 31, 2026

z-ryota-yamada added 2 commits June 6, 2026 18:05

Merge remote-tracking branch 'origin' into feat/plugin-gtm

cf09f82

Merge branch 'feat/plugin-gtm' of github.com:ryota-yamada-jp/emdash i…

a68a9d8

…nto feat/plugin-gtm

	capabilities: ["page:inject"],
	capabilities: ["hooks.page-fragments:register"],

Conversation

ryota-yamada-jp commented Apr 3, 2026

What does this PR do?

Type of change

Checklist

AI-generated code disclosure

Screenshots / test output

Uh oh!

changeset-bot Bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ryota-yamada-jp commented Apr 3, 2026

Uh oh!

ryota-yamada-jp commented Apr 3, 2026

Uh oh!

ryota-yamada-jp commented Apr 3, 2026

Uh oh!

z-ryota-yamada commented Apr 3, 2026

Uh oh!

ascorbic commented Apr 11, 2026

Uh oh!

ryota-yamada-jp commented Apr 13, 2026

Uh oh!

ryota-yamada-jp commented Apr 15, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

PR template validation failed

Uh oh!

pkg-pr-new Bot commented May 11, 2026

Uh oh!

emdashbot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

emdashbot Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

emdashbot Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

emdashbot Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

emdashbot Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

emdashbot Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot Bot commented Apr 3, 2026 •

edited

Loading

github-actions Bot commented Apr 3, 2026 •

edited

Loading