backup/pywb
1
0
Fork 0
mirror of https://github.com/webrecorder/pywb.git synced 2025-03-15 00:03:28 +01:00
Code Issues Projects Releases Activity

postMessage edge cases fixes: safer postmessage: (#328)

Browse Source 
- if targetOrigin is the replay host, default to unrewritten from origin, not '*'
- don't set targetOrigin to 'null' or empty to avoid errors
- if target window's unrewritten origin is actually 'null' or '', don't pass message at all, and don't set to '*' -- represents actual behavior,
as postMessage to 'null' origin (about:blank page) will be received only if targetOrigin is already '*'.
This commit is contained in:
Ilya Kreymer 2018-05-21 13:13:36 -07:00 committed by GitHub
parent 1faa75a126
commit f65ac7068f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pywb/static/wombat.js
View File

@ -2209,9 +2209,11 @@ var _WBWombat = function($wbwindow, wbinfo) {
}
var to_origin = targetOrigin;
if (starts_with(to_origin, obj.location.origin)) {
to_origin = "*";
// if passed in origin is the replay (rewriting missed somewhere?)
// set origin to current 'from' origin
if (to_origin == obj.location.origin) {
to_origin = from;
}
var new_message = {"from": from,
@ -2221,7 +2223,14 @@ var _WBWombat = function($wbwindow, wbinfo) {
"from_top": from_top,
}
// set to 'real' origin if not '*'
if (targetOrigin != "*") {
// if target origin is null (about:blank) or empty, don't pass event at all
// as it would never succeed
if (obj.location.origin == "null" || obj.location.origin == "") {
return;
}
// set to actual (rewritten) origin
targetOrigin = obj.location.origin;
}