Skip to content
This repository was archived by the owner on Sep 11, 2024. It is now read-only.

Tweak UIA postMessage check to work cross-origin #12878

Merged
t3chguy merged 4 commits into from
Aug 16, 2024
Merged

Tweak UIA postMessage check to work cross-origin #12878

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
34f9404
Soften UIA fallback postMessage check to work cross-origin
t3chguy Aug 9, 2024
0b64177
Do the same for the SSO UIA flow
t3chguy Aug 14, 2024
974f12a
Check against MessageEvent::source instead
t3chguy Aug 15, 2024
7a06cc0
Merge branch 'develop' into t3chguy/uia-x-signing
t3chguy Aug 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/components/views/auth/InteractiveAuthEntryComponents.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,7 +833,9 @@ export class SSOAuthEntry extends React.Component<ISSOAuthEntryProps, ISSOAuthEn
};

private onReceiveMessage = (event: MessageEvent): void => {
if (event.data === "authDone" && event.origin === this.props.matrixClient.getHomeserverUrl()) {
// We don't check the origin here as we don't trust any incoming data and just use it as a ping to retry the request,
// and the HS may delegate the fallback to another origin, due to CORS we cannot inspect the origin of the popupWindow.
Comment thread
t3chguy marked this conversation as resolved.
Outdated
if (event.data === "authDone") {
if (this.popupWindow) {
this.popupWindow.close();
this.popupWindow = null;
Expand Down Expand Up @@ -950,7 +952,9 @@ export class FallbackAuthEntry extends React.Component<IAuthEntryProps> {
};

private onReceiveMessage = (event: MessageEvent): void => {
if (event.data === "authDone" && event.origin === this.props.matrixClient.getHomeserverUrl()) {
// We don't check the origin here as we don't trust any incoming data and just use it as a ping to retry the request,
// and the HS may delegate the fallback to another origin, due to CORS we cannot inspect the origin of the popupWindow.
if (event.data === "authDone") {
this.props.submitAuthDict({});
}
};
Expand Down