[] fix(security): validate postMessage origins and fix slack middleware path

apps/jira/jira-app/src/components/Auth/OAuth.tsx

@@ -28,7 +28,7 @@ export default class OAuth extends React.Component<Props> {
     const oauthWindow = window.open(url, 'Jira Contentful', 'left=150,top=10,width=800,height=900');
 
     window.addEventListener('message', (e) => {
-      if (e.source !== oauthWindow) {
+      if (e.source !== oauthWindow || e.origin !== window.location.origin) {
         return;
       }
 

apps/jira/jira-app/src/index.spec.tsx

@@ -227,7 +227,14 @@ describe('The Jira App Components', () => {
       (window.open as Mock).mockReturnValue(source);
 
       fireEvent.click(oauthButton);
-      fireEvent(window, new MessageEvent('message', { data: { token, expireTime }, source }));
+      fireEvent(
+        window,
+        new MessageEvent('message', {
+          data: { token, expireTime },
+          source,
+          origin: 'http://localhost:3000',
+        })
+      );
 
       expect(window.open).toHaveBeenCalledWith(
         'https://auth.atlassian.com/authorize?audience=api.atlassian.com&client_id=XD9k9QU9VT4Rt26u6lbO3NM0fOqvvXan&scope=read%3Ajira-user%20read%3Ajira-work%20write%3Ajira-work&redirect_uri=https%3A%2F%2Fapi.jira.ctfapps.net%2Fauth&response_type=code&state=http%3A%2F%2Flocalhost%3A3000%2F&prompt=consent',
@@ -249,7 +256,14 @@ describe('The Jira App Components', () => {
       (window.open as Mock).mockReturnValue(source);
 
       fireEvent.click(oauthButton);
-      fireEvent(window, new MessageEvent('message', { data: { error }, source }));
+      fireEvent(
+        window,
+        new MessageEvent('message', {
+          data: { error },
+          source,
+          origin: 'http://localhost:3000',
+        })
+      );
 
       expect(mockSdk.notifier.error).toHaveBeenCalledWith(
         'There was an error authenticating. Please refresh and try again.'
@@ -580,7 +594,7 @@ describe('The Jira App Components', () => {
       standalone(mockWindow as any);
       expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
         { token: '123', expireTime: 10100 },
-        '*'
+        'http://localhost:1234'
       );
       expect(mockWindow.history.replaceState).toHaveBeenCalledWith({}, 'oauth', '/');
     });
@@ -605,7 +619,10 @@ describe('The Jira App Components', () => {
       standalone(mockWindow as any);
 
       expect(mockWindow.localStorage.setItem).toHaveBeenCalledTimes(0);
-      expect(mockWindow.opener.postMessage).toHaveBeenCalledWith({ error: errorMessage }, '*');
+      expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
+        { error: errorMessage },
+        'http://localhost:1234'
+      );
     });
 
     it('should handle no query string', () => {
@@ -629,7 +646,7 @@ describe('The Jira App Components', () => {
       expect(mockWindow.localStorage.setItem).toHaveBeenCalledTimes(0);
       expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
         { error: 'No query string provided!' },
-        '*'
+        'http://localhost:1234'
       );
     });
   });

apps/jira/jira-app/src/standalone.ts

@@ -1,11 +1,11 @@
 const standalone = (window: Window) => {
-  const { searchParams, search } = new URL(window.location.href);
+  const { searchParams, search, origin } = new URL(window.location.href);
 
   if (search.length) {
     const error = searchParams.get('error');
 
     if (error) {
-      window.opener.postMessage({ error }, '*');
+      window.opener.postMessage({ error }, origin);
       return;
     }
 
@@ -14,11 +14,11 @@ const standalone = (window: Window) => {
 
     const expireTime = Date.now() + expiresIn * 1000;
 
-    window.opener.postMessage({ token, expireTime }, '*');
+    window.opener.postMessage({ token, expireTime }, origin);
 
     window.history.replaceState({}, 'oauth', '/');
   } else {
-    window.opener.postMessage({ error: 'No query string provided!' }, '*');
+    window.opener.postMessage({ error: 'No query string provided!' }, origin);
   }
 };
 export default standalone;

apps/slack/frontend/src/index.tsx

@@ -9,13 +9,17 @@ import { CustomSDKProvider } from './CustomSDKProvider';
 const params = new URLSearchParams(window.location.search);
 
 if (params.has('result')) {
-  window.opener.postMessage({
-    result: params.get('result'),
-    state: params.get('state'),
-    accessToken: params.get('accessToken'),
-    refreshToken: params.get('refreshToken'),
-    errorMessage: params.get('errorMessage'),
-  });
+  const { origin } = new URL(window.location.href);
+  window.opener.postMessage(
+    {
+      result: params.get('result'),
+      state: params.get('state'),
+      accessToken: params.get('accessToken'),
+      refreshToken: params.get('refreshToken'),
+      errorMessage: params.get('errorMessage'),
+    },
+    origin
+  );
   window.close();
 } else {
   const root = document.getElementById('root');

apps/slack/frontend/src/useConnect.ts

@@ -63,6 +63,9 @@ export const useConnect = () => {
   const [setTemporaryRefreshToken] = useAuthStore((state) => [state.setTemporaryRefreshToken]);
 
   const onMessage = async (message: MessageEvent) => {
+    if (message.origin !== window.location.origin) {
+      return;
+    }
     if (message.data.result === 'error') {
       sdk.notifier.error('Something went wrong while authenticating with Slack. Please try again.');
     }

apps/smartling/frontend/src/Sidebar.tsx

@@ -177,8 +177,8 @@ export default class Sidebar extends React.Component<Props, State> {
     } else if (refresh.failed) {
       const smartlingWindow = window.open('/openauth', '', 'height=600,width=600,top=50,left=50');
 
-      const listener = ({ data, source }: any) => {
-        if (source !== smartlingWindow) {
+      const listener = ({ data, source, origin }: any) => {
+        if (source !== smartlingWindow || origin !== window.location.origin) {
           return;
         }
 

apps/smartling/frontend/src/standalone.ts

@@ -1,5 +1,5 @@
 const standalone = (window: Window) => {
-  const { searchParams, search } = new URL(window.location.href);
+  const { searchParams, search, origin } = new URL(window.location.href);
   window.history.replaceState({}, 'smartling', '/');
 
   if (search.length) {
@@ -8,7 +8,7 @@ const standalone = (window: Window) => {
 
     window.localStorage.setItem('token', token);
     window.localStorage.setItem('refreshToken', refreshToken);
-    window.opener.postMessage({ token, refreshToken }, '*');
+    window.opener.postMessage({ token, refreshToken }, origin);
   }
 };
 export default standalone;