[media] Check origin of messages

[dayo09]

This commit checks origin of messages in event handlers

ONE-vscode-DCO-1.0-Signed-off-by: Dayoung Lee [email protected]

---

For #1624 (comment)

[dayo09]

@seanshpark I noticed that there is a potential security problem from Verify the origin of the received message.

I assumed that the messages are coming from the window's origin, would it be okay for CircleGraph?

[seanshpark]

I'm not sure about technical background of this, but I think event itself would be coming from vscode process(? or thread?, the node-js).
And not sure about the fix but if this has no problem loading the model, I think it would be OK.

[jyoungyun]

I agree this changes because this is a similar solution from sonarsource.com.

https://rules.sonarsource.com/javascript/RSPEC-2819/

window.addEventListener("message", function(event) {

  if (event.origin !== "http://example.org") // Compliant
    return;

  console.log(event.data)
});

[dayo09]

@jyoungyun I actually referred that solution :-D

[dayo09]

@jyoungyun PTAL :-D

(Should I Pr this drafts at once or separately?)

[jyoungyun]

@dayo09 Could you update the commit title so that there is no DRAFT: prefix. :)

[jyoungyun]

LGTM

[seanshpark]

LGTM