fix: prevent XSS (#486)

Co-authored-by: Anthony Fu <anthonyfu117@hotmail.com>
slidevjs · Feb 18, 2022 · 92db175 · 92db175
1 parent aae017d
commit 92db175
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/packages/client/iframes/monaco/index.ts b/packages/client/iframes/monaco/index.ts
@@ -135,6 +135,8 @@ async function start() {
 window.addEventListener('message', (payload) => {
   if (payload.source === window)
     return
+  if (payload.origin !== location.origin)
+    return
   if (typeof payload.data !== 'string')
     return
   const { type, data } = JSON.parse(payload.data)