Pre release changes #134
Pre release changes #134
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| iframeRef.value.contentWindow.postMessage({ | ||
| namespace, | ||
| token, // Will be set for OIDC, null for basic auth | ||
| sessionId // Will be set for both, used by basic auth | ||
| }, '*') |
Check warning
Code scanning / CodeQL
Cross-window communication with unrestricted target origin Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, the fix is to avoid postMessage(..., '*') when sending sensitive data. Instead, specify a concrete, trusted target origin (e.g., 'https://example.com' or window.location.origin) that matches the origin from which /graphiql.html is served. This ensures that even if a malicious page tries to embed the iframe or intercept the message, the browser will not deliver it unless the target’s origin matches the specified value.
For this specific file, we should:
- Compute the correct target origin at runtime based on the current page’s origin, assuming
/graphiql.htmlis served from the same origin. - Replace the
'*'argument inpostMessagewith that origin. - Keep existing behavior otherwise unchanged (same data, same timing, same event listener).
Concretely, inside onMounted, before adding the load listener, we can define:
const targetOrigin = window.location.originThen update:
iframeRef.value.contentWindow.postMessage({ ... }, '*')to:
iframeRef.value.contentWindow.postMessage({ ... }, targetOrigin)This preserves existing functionality (the iframe is same-origin, so the message still arrives) while enforcing an origin restriction, satisfying CodeQL and improving security. No new imports or external libraries are required.
| @@ -22,7 +22,8 @@ | ||
|
|
||
| onMounted(() => { | ||
| const namespace = getQueryParam('namespace') || 'default' | ||
|
|
||
| const targetOrigin = window.location.origin | ||
|
|
||
| // Determine auth method based on whether we have an OIDC user | ||
| const isOidcAuth = USER_STATE.oidcUser !== null | ||
| const token = isOidcAuth ? Cookies.get('token') : null | ||
| @@ -38,7 +39,7 @@ | ||
| namespace, | ||
| token, // Will be set for OIDC, null for basic auth | ||
| sessionId // Will be set for both, used by basic auth | ||
| }, '*') | ||
| }, targetOrigin) | ||
| }) | ||
| }) | ||
| </script> |
| iframeRef.value.contentWindow.postMessage({ | ||
| namespace, | ||
| token, // Will be set for OIDC, null for basic auth | ||
| sessionId // Will be set for both, used by basic auth | ||
| }, '*') |
Check warning
Code scanning / CodeQL
Cross-window communication with unrestricted target origin Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, the fix is to restrict postMessage to a specific, trusted origin instead of using '*'. That way, even if the iframe or window is navigated to a malicious site, the browser will not deliver the sensitive message unless the recipient’s origin matches the expected value.
For this specific code, the least invasive change that preserves existing behavior is to replace the '*' target origin with window.location.origin, assuming /scalar-ui.html is served from the same origin as the parent app. This keeps communication working in the normal deployment (same-origin iframe) while preventing the message from being delivered if the iframe is ever navigated to another origin. We only need to modify the postMessage call inside the load event listener in OpenAPIPlayground.vue; no new imports or helper functions are required.
Concretely:
- In
structures-frontend-next/src/pages/OpenAPIPlayground.vue, update line 41 from}, '*')to}, window.location.origin). - Leave the rest of the logic (namespace, token, sessionId preparation and event handling) unchanged.
| @@ -38,7 +38,7 @@ | ||
| namespace, | ||
| token, // Will be set for OIDC, null for basic auth | ||
| sessionId // Will be set for both, used by basic auth | ||
| }, '*') | ||
| }, window.location.origin) | ||
| }) | ||
| }) | ||
| </script> |
No description provided.