Core 954 window help menu - #103
Conversation
Ha, maybe I should stash changes that are WIP before updating snapshots
These might change after rendering, in which case they should be set immediately if we were ready once before.
|
|
||
| const handleMessage = (e: MessageEvent) => { | ||
| const { source, data: { type } } = e; | ||
| if (source !== popup.current) return; |
There was a problem hiding this comment.
Should we also enforce that the origin matches the popup origin?
There was a problem hiding this comment.
@jivey I am not sure we can check that if the popup is cross-origin. I am getting this error when I try :
Uncaught SecurityError: Failed to read a named property 'origin' from 'Window': Blocked a frame with origin "..." from accessing a cross-origin frame.
Granted, I think this would share the same origin as the chat embed popup in a real situation (but there's no guarantee of that since the path is passed in).
Is there a reason to compare the origin too? I would have thought that comparing the objects directly would be most secure. It's effectively checking if the message is from the window the help menu opened, right?
There was a problem hiding this comment.
No I think you're right, I don't remember what my thought/concern here was.
… CORE-954-window-help-menu
2 participants
https://openstax.atlassian.net/browse/CORE-954
Remote-controlled chat.