codeninjasllc/codecombat
1
0
Fork 0
mirror of https://github.com/codeninjasllc/codecombat.git synced 2025-05-01 00:15:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Slightly more flexible iframe origin checking

Browse source
This commit is contained in:
Nick Winter 2016-07-15 11:19:22 -07:00
parent 1e640fb74c
commit 5a688e42c7
2 changed files with 11 additions and 6 deletions
app
assets/javascripts
web-dev-listener.js
views/play/level
WebSurfaceView.coffee

15
app/assets/javascripts/web-dev-listener.js
View file

@ -7,15 +7,20 @@ var virtualDOM;
var goalStates; var goalStates;
var allowedOrigins = [ var allowedOrigins = [
'https://codecombat.com', /https:\/\/codecombat\.com/,
'http://localhost:3000', /http:\/\/localhost:3000/,
'http://direct.codecombat.com', /http:\/\/direct\.codecombat\.com/,
'http://staging.codecombat.com' /http:\/\/staging\.codecombat\.com/,
/http:\/\/codecombat-staging-codecombat\.runnableapp\.com/,
]; ];
function receiveMessage(event) { function receiveMessage(event) {
var origin = event.origin || event.originalEvent.origin; // For Chrome, the origin property is in the event.originalEvent object. var origin = event.origin || event.originalEvent.origin; // For Chrome, the origin property is in the event.originalEvent object.
if (allowedOrigins.indexOf(origin) == -1) { var allowed = false;
allowedOrigins.forEach(function(pattern) {
allowed = allowed || pattern.test(origin);
});
if (!allowed) {
console.log('Ignoring message from bad origin:', origin); console.log('Ignoring message from bad origin:', origin);
return; return;
} }

2
app/views/play/level/WebSurfaceView.coffee
View file

@ -50,7 +50,7 @@ module.exports = class WebSurfaceView extends CocoView
onIframeMessage: (e) => onIframeMessage: (e) =>
origin = e.origin or e.originalEvent.origin origin = e.origin or e.originalEvent.origin
unless origin in ['https://codecombat.com', 'http://localhost:3000'] unless origin is window.location.origin
return console.log 'Ignoring message from bad origin:', origin return console.log 'Ignoring message from bad origin:', origin
unless event.source is @iframe.contentWindow unless event.source is @iframe.contentWindow
return console.log 'Ignoring message from somewhere other than our iframe:', event.source return console.log 'Ignoring message from somewhere other than our iframe:', event.source