github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce parent-child relationship in custom postMessage() handler (#21529)

Browse Source
This commit is contained in:
Milan Burda
2019-12-16 17:13:17 +01:00
committed by Shelley Vohr
parent 8c531ed424
commit 32aca15962
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/browser/guest-window-manager.js
View File

@@ -317,6 +317,11 @@ ipcMainInternal.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_POSTMESSAGE', function
// The W3C does not seem to have word on how postMessage should work when the
// origins do not match, so we do not do |canAccessWindow| check here since
// postMessage across origins is useful and not harmful.
if (!isRelatedWindow(event.sender, guestContents)) {
console.error(`Blocked ${event.sender.getURL()} from calling postMessage.`)
return
}
if (targetOrigin === '*' || isSameOrigin(guestContents.getURL(), targetOrigin)) {
const sourceId = event.sender.id
guestContents._sendInternal('ELECTRON_GUEST_WINDOW_POSTMESSAGE', sourceId, message, sourceOrigin)