forked from treehouse/mastodon
Fixed prototype pollution bug and only allow trusted origin (#17420)
parent
54581d43e7
commit
4d6d4b43c6
|
@ -15,7 +15,7 @@
|
||||||
window.addEventListener('message', function(e) {
|
window.addEventListener('message', function(e) {
|
||||||
var data = e.data || {};
|
var data = e.data || {};
|
||||||
|
|
||||||
if (data.type !== 'setHeight' || !iframes[data.id]) {
|
if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue