Parent origin whitelist for h5p-postmessage.

See #3364.
openlab-at-city-tech · Aug 6, 2024 · bec620a · bec620a
1 parent 712173f
commit bec620a
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/wp-content/plugins/h5p-postmessage/assets/src/frontend.js b/wp-content/plugins/h5p-postmessage/assets/src/frontend.js
@@ -58,6 +58,12 @@
 			return;
 		}
 
+		const { allowedDomains } = window.h5pPostMessageData;
+
+		if ( ! allowedDomains.includes( window.parent.origin ) ) {
+			return;
+		}
+
 		window.parent.postMessage( postMessageData, '*' );
 	});
 })();
diff --git a/wp-content/plugins/h5p-postmessage/h5p-postmessage.php b/wp-content/plugins/h5p-postmessage/h5p-postmessage.php
@@ -31,6 +31,19 @@ function( &$tags ) {
 			plugin_dir_url( __FILE__ ) . 'build/frontend.js'
 		);
 
+		// Default to the current domain only.
+		$url_parts       = wp_parse_url( get_site_url() );
+		$allowed_domains = [ $url_parts['scheme'] . '://' . $url_parts['host'] ];
+
+		$data = [
+			'allowedDomains' => apply_filters( 'h5p_postmessage_allowed_domains', $allowed_domains ),
+		];
+
+		$tags[] = sprintf(
+			'<script>var h5pPostMessageData = %s;</script>',
+			wp_json_encode( $data )
+		);
+
 		return $tags;
 	}
 );