fix(chat): target the manage readiness ping at a concrete parent origin

The embedded assistant announced readiness with a '*' wildcard
postMessage target, which SonarQube flags as a CRITICAL vulnerability:
any window origin could receive the ping. The Manage parent now forwards
its own origin as a parentOrigin query param; the child validates it is a
bare, well-formed origin and targets the ping there, and skips the
proactive ping when the param is absent. The parent's existing retry
burst still delivers the context in that case, so no behavior regresses.

Author: rschlaefli

apps/chat/src/hooks/useEmbeddedManageContext.ts

@@ -1,5 +1,6 @@
 'use client'
 
+import { useSearchParams } from 'next/navigation'
 import { useEffect, useRef, useState } from 'react'
 import {
   sanitizeManageAssistantContext,
@@ -14,6 +15,8 @@ const MANAGE_CONTEXT_READY_MESSAGE_TYPE = 'klicker:manage-context-ready'
 
 export function useEmbeddedManageContext() {
   const embedded = useEmbedded()
+  const searchParams = useSearchParams()
+  const parentOrigin = parseOrigin(searchParams.get('parentOrigin'))
   const [context, setContext] = useState<ManageAssistantContext | null>(null)
   const contextKeyRef = useRef<string | null>(null)
   const setManageParentOrigin = useManageParentStore(
@@ -70,12 +73,19 @@ export function useEmbeddedManageContext() {
     // Announce readiness so the parent (re)sends the current context exactly
     // when this listener exists. Without this, the parent's timed retry burst
     // can fully elapse before hydration finishes and the context is lost. The
-    // '*' target is safe: the message is a content-free ping and the parent
-    // origin is unknown until its first context message arrives.
-    window.parent.postMessage({ type: MANAGE_CONTEXT_READY_MESSAGE_TYPE }, '*')
+    // parent hands us its own origin as a query param, so target the ping at
+    // that concrete origin; if it is absent, skip the proactive ping and let
+    // the parent's retry burst deliver the context rather than broadcasting to
+    // a '*' wildcard.
+    if (parentOrigin) {
+      window.parent.postMessage(
+        { type: MANAGE_CONTEXT_READY_MESSAGE_TYPE },
+        parentOrigin
+      )
+    }
 
     return () => window.removeEventListener('message', handleMessage)
-  }, [embedded, setManageParentOrigin])
+  }, [embedded, parentOrigin, setManageParentOrigin])
 
   return context
 }
@@ -91,3 +101,14 @@ function isManageContextMessage(data: unknown): data is {
     (data as { type?: unknown }).type === MANAGE_CONTEXT_MESSAGE_TYPE
   )
 }
+
+// Accept the query param only when it is a bare, well-formed origin so it can
+// never be a '*' wildcard or a full URL when used as a postMessage target.
+function parseOrigin(value: string | null): string | null {
+  if (!value) return null
+  try {
+    return new URL(value).origin === value ? value : null
+  } catch {
+    return null
+  }
+}

apps/frontend-manage/src/components/assistant/ManageAssistantWidget.tsx

@@ -52,6 +52,8 @@ export function ManageAssistantWidget() {
       buildManageAssistantUrl({
         chatUrl: process.env.NEXT_PUBLIC_CHAT_URL,
         locale: router.locale,
+        parentOrigin:
+          typeof window !== 'undefined' ? window.location.origin : undefined,
       }),
     [router.locale]
   )

apps/frontend-manage/src/components/assistant/manageAssistantConfig.ts

@@ -1,6 +1,7 @@
 type BuildManageAssistantUrlArgs = {
   chatUrl?: string
   locale?: string
+  parentOrigin?: string
 }
 
 export function isManageAssistantEnabled(value: string | undefined): boolean {
@@ -10,6 +11,7 @@ export function isManageAssistantEnabled(value: string | undefined): boolean {
 export function buildManageAssistantUrl({
   chatUrl,
   locale,
+  parentOrigin,
 }: BuildManageAssistantUrlArgs): string | null {
   if (!chatUrl) return null
 
@@ -21,6 +23,12 @@ export function buildManageAssistantUrl({
       url.searchParams.set('locale', locale)
     }
 
+    // Hand the embedder's own origin to the embedded assistant so its
+    // readiness ping can target a concrete origin instead of a '*' wildcard.
+    if (parentOrigin) {
+      url.searchParams.set('parentOrigin', parentOrigin)
+    }
+
     return url.toString()
   } catch {
     return null

apps/frontend-manage/test/manageAssistantConfig.test.ts

@@ -18,6 +18,17 @@ assert.equal(
   'https://chat.klicker.com/manage?embed=true&locale=de'
 )
 
+// The embedder origin is forwarded so the embedded assistant can target its
+// readiness ping at a concrete origin instead of a '*' wildcard.
+assert.equal(
+  buildManageAssistantUrl({
+    chatUrl: 'https://chat.klicker.com/',
+    locale: 'de',
+    parentOrigin: 'https://manage.klicker.com',
+  }),
+  'https://chat.klicker.com/manage?embed=true&locale=de&parentOrigin=https%3A%2F%2Fmanage.klicker.com'
+)
+
 assert.equal(
   buildManageAssistantUrl({
     chatUrl: undefined,