Repository navigation
fix(security): accept host events only from window.parent - #193
pritesh-jain-cstk wants to merge 2 commits into
Conversation
extensionEvent and uploadReady_<uid> listeners had no window filter, so post-robot accepted them from any frame, including sibling app iframes. Scope both to window.parent, the window that holds the app iframe and the only sender in app-extension-component. The local post-robot typing gains the options argument that post-robot 8 already accepts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
🟠 High Severity - SLA Breached Issues (with fixes)Showing 6 issue(s) that have exceeded the 30-day SLA threshold:
🟡 Medium Severity - SLA Breached Issues (with fixes)Showing 10 issue(s) that have exceeded the 90-day SLA threshold:
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
❌ BUILD FAILED - Security checks failed Please review and fix the security vulnerabilities before merging. |
…T-22128)
jsdom's window.parent is window, so the old assertion also passed with
{ window: window }. Stub the parent getter and assert against the stub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
🟠 High Severity - SLA Breached Issues (with fixes)Showing 6 issue(s) that have exceeded the 30-day SLA threshold:
🟡 Medium Severity - SLA Breached Issues (with fixes)Showing 10 issue(s) that have exceeded the 90-day SLA threshold:
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
❌ BUILD FAILED - Security checks failed Please review and fix the security vulnerabilities before merging. |
Drop the internal workflow block, internal wiki links and Jira keys; known traps stated inline; listener rule links PR #193. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Branch graph
Epic MKT-21672. This PR is highlighted. Only [Routine] depends on [Tests]; the rest are independent.
What
Jira: MKT-22128
Consumer impact (runtime, bug fix): messages on the
extensionEventanduploadReady_<uid>post-robot channels are now accepted only fromwindow.parent. Messages on those channels from any other window (a sibling app iframe, a popup) are ignored. Nothing else changes:dist/src/**/*.d.tshas no diff betweenmainand this branch, and no exported name, type or signature changes.src/uiLocation.tsandsrc/stack/api/asset/index.tscalledpostRobot.on(name, handler)with nowindow/domainoption. post-robot 8 then accepts the message from any window and origin (node_modules/post-robot/src/public/server.js:domain || WILDCARD,windowundefined). Every Marketplace app on a page is a sibling iframe, so any of them could send a fakeentrySave/entryChange/contentTypeSave/onError(and so on) to another app and run itsonSave/onChangecallbacks with chosen data.app-extension-componentsends both channels from the window that holds the iframe (postRobotConfig.ts:postRobot.client({ window: iframe.contentWindow });events.tsx:postRobot.send(iframeReference.contentWindow,uploadReady_${uid})). That window is the app'swindow.parent, the same window that answersinit. The host side already scopes its listeners per iframe; the SDK side did not. JSON RTE plugins run in the shared RTE iframe, hosted by UI-React, whose source I could not read: that sender is inferred (wikiapp-platform-communication.md, and venus-componentsJsonRTE/lib/requestModulewhose ownuploadReady_listener replies towindow.parent). Before merge, check in UI-React that RTE events reach the RTE iframe from its parent; if not, this change would drop them.{ window: window.parent }on both listeners.src/types/post-robot.d.ts(a local ambient declaration, not shipped indist) gains theoptionsargument that post-robot already accepts, matching itsoncedeclaration.__test__/hostOnlyListeners.test.ts(2 tests). jsdom'swindow.parentiswindow, so the tests stub theparentgetter with a distinct object and assert against it. Mutation check:{ window: window }or no option on either listener fails its test.window.parent.postMessage(..., "*")upload post goes to the same parentsendToParentalready talks to.Readiness items
Security Bug found in the fix track (MKT-22128)
Commands (exit codes, Node 24 locally)
npm cinpm run lintnpm run buildnpx tsc --noEmit -p .npm testnpm audit --omit=devCI:
security-scafails here as onmain: the lock pins axios 1.16.0 (8 High). That is fixed by #191 (MKT-22129 links it), not by this PR. The pre-push hook (npm test) passed on every push; none bypassed. Local Snyk cannot authenticate (SNYK-0005); the PR's Snyk checks are the scan.🤖 Generated with Claude Code