From 6425b2f53bb2d307e5f197a9dc75e06b5a3041d9 Mon Sep 17 00:00:00 2001 From: Dorian Date: Fri, 6 Mar 2026 01:31:45 +0000 Subject: [PATCH] fix(app): restrict postMessage origin in archyBridge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change default allowedOrigin from '*' to null. Derive from window.location.origin when init() is called without explicit origin. Always validate event.origin — reject messages when origin is not set. Co-Authored-By: Claude Opus 4.6 --- packages/app/src/services/archyBridge.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/packages/app/src/services/archyBridge.ts b/packages/app/src/services/archyBridge.ts index ba0616fc..953798c7 100644 --- a/packages/app/src/services/archyBridge.ts +++ b/packages/app/src/services/archyBridge.ts @@ -36,7 +36,7 @@ const themeCallbacks: ThemeCallback[] = [] let currentPermissions: AIContextCategory[] = [] let currentTheme: ThemeInfo | null = null let initialized = false -let allowedOrigin = '*' +let allowedOrigin: string | null = null function generateId(): string { return `aiui-${++requestId}-${Date.now()}` @@ -44,12 +44,13 @@ function generateId(): string { function postToParent(msg: unknown) { if (window.parent === window) return // Not in iframe + if (!allowedOrigin) return // Origin not configured window.parent.postMessage(msg, allowedOrigin) } function handleMessage(event: MessageEvent) { - // Validate origin when configured - if (allowedOrigin !== '*' && event.origin !== allowedOrigin) return + // Always validate origin — reject if not configured or mismatched + if (!allowedOrigin || event.origin !== allowedOrigin) return const msg = event.data if (!msg || typeof msg.type !== 'string') return @@ -98,7 +99,8 @@ export const archyBridge = { init(origin?: string) { if (initialized) return initialized = true - if (origin) allowedOrigin = origin + // Use explicit origin or derive from current location (self-only) + allowedOrigin = origin ?? window.location.origin window.addEventListener('message', handleMessage) postToParent({ type: 'ready' }) },