search

postaljs / postal.xframe

postal.js add-on providing the ability to federate instances of postal across iframe/window boundaries
Other
37 stars 38 forks source link

check the origin when routing message to secure event listener for a i… #32

Closed jaldipp closed 7 years ago

jaldipp commented 7 years ago

This is to secure the event listener to make sure the origin is in the allowed origin list. Currently, all messages are routed from iframe to parent and the iframe postal instance can't restrict by allowed origins.

I am suggesting this additional check because failure to check the origin and possibly source properties enables cross-site scripting attacks.