fix: check the source when handling events (#671)

onbloc · Jan 30, 2025 · c987a23 · c987a23
1 parent 38f089a
commit c987a23
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 16 deletions.
diff --git a/packages/adena-extension/src/content.ts b/packages/adena-extension/src/content.ts
@@ -5,7 +5,9 @@ const sendMessage = (event: MessageEvent): void => {
   const message = event.data;
   chrome.runtime.sendMessage(message, (response) => {
     Promise.resolve(response).then((result) => {
-      event.source?.postMessage(result);
+      event.source?.postMessage(result, {
+        targetOrigin: event.origin,
+      });
     });
     return true;
   });
@@ -21,21 +23,24 @@ const loadScript = (): void => {
 };
 
 const initListener = (): void => {
-  window.addEventListener(
-    'message',
-    (event) => {
-      try {
-        if (event.data?.status === 'request') {
-          sendMessage(event);
-        } else {
-          return event.data;
-        }
-      } catch (e) {
-        console.error(e);
+  const listener = (event: MessageEvent): void => {
+    if (event.origin !== window.location.origin) {
+      console.warn(`Untrusted origin: ${event.origin}`);
+      return;
+    }
+
+    try {
+      if (event.data?.status === 'request') {
+        sendMessage(event);
+      } else {
+        return event.data;
       }
-    },
-    false,
-  );
+    } catch (e) {
+      console.error(e);
+    }
+  };
+
+  window.addEventListener('message', listener, false);
 };
 
 const initExtensionListener = (): void => {

diff --git a/packages/adena-extension/src/inject/executor/executor.ts b/packages/adena-extension/src/inject/executor/executor.ts
@@ -169,7 +169,8 @@ export class AdenaExecutor {
       hostname: window.location.hostname,
       key: this.eventKey,
     };
-    window.postMessage(this.eventMessage, '*');
+
+    window.postMessage(this.eventMessage, window.location.origin);
     this.messages[this.eventKey] = {
       request: this.eventMessage,
       response: undefined,
@@ -201,6 +202,11 @@ export class AdenaExecutor {
   };
 
   private messageHandler = (event: MessageEvent<InjectionMessage>): void => {
+    if (event.origin !== window.location.origin) {
+      console.warn(`Untrusted origin: ${event.origin}`);
+      return;
+    }
+
     const eventData = event.data;
     if (eventData.status) {
       const { key, status, data, code, message, type } = eventData;