fix: add origin check#2183
Conversation
Signed-off-by: Mateusz Piątkowski <mateusz.piatkowski@digitalasset.com>
| if ( | ||
| event.origin !== window.location.origin || | ||
| !isSpliceMessageEvent(event) | ||
| ) |
There was a problem hiding this comment.
hmm aren't these always non-matching though? supposing the WG popup is loaded on https://wg.com origin and the dapp is loaded on https://mydapp.com origin. A message emitted from the popup is always a separate origin from the dapp (and vice versa)
I ran into basically the same issue with the multi-session PR, and came up with a sort of two-way handshake (request + ack back) to establish the expected origin: https://github.com/canton-network/wallet/pull/2161/changes#diff-996a6861dc1de45e9046316868d78c3584267529d4a02e513e9151da2a2b7e13R141
maybe we need to extend something like this so that the popup maintains a list of known dapp origins in LocalStorage, and reject if the event comes from an origin outside that list
There was a problem hiding this comment.
sounds good! I'll make the changes :)
2 participants
No description provided.