From 2ced4830f6593dcec94d40dca0ae33a1a502f918 Mon Sep 17 00:00:00 2001 From: Dorian Date: Wed, 4 Mar 2026 22:17:24 +0000 Subject: [PATCH] fix(app): add postMessage origin validation to archyBridge Configurable origin replaces wildcard '*' for both sending and receiving. Origin check filters incoming messages when a specific origin is set. Co-Authored-By: Claude Opus 4.6 --- packages/app/src/services/archyBridge.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/packages/app/src/services/archyBridge.ts b/packages/app/src/services/archyBridge.ts index de42350a..5ea68738 100644 --- a/packages/app/src/services/archyBridge.ts +++ b/packages/app/src/services/archyBridge.ts @@ -36,6 +36,7 @@ const themeCallbacks: ThemeCallback[] = [] let currentPermissions: AIContextCategory[] = [] let currentTheme: ThemeInfo | null = null let initialized = false +let allowedOrigin = '*' function generateId(): string { return `aiui-${++requestId}-${Date.now()}` @@ -43,10 +44,13 @@ function generateId(): string { function postToParent(msg: unknown) { if (window.parent === window) return // Not in iframe - window.parent.postMessage(msg, '*') + window.parent.postMessage(msg, allowedOrigin) } function handleMessage(event: MessageEvent) { + // Validate origin when configured + if (allowedOrigin !== '*' && event.origin !== allowedOrigin) return + const msg = event.data if (!msg || typeof msg.type !== 'string') return @@ -91,9 +95,10 @@ export const archyBridge = { * Initialize the bridge. Call once on app mount. * Sends 'ready' to Archy so it knows the iframe is loaded. */ - init() { + init(origin?: string) { if (initialized) return initialized = true + if (origin) allowedOrigin = origin window.addEventListener('message', handleMessage) postToParent({ type: 'ready' }) },