feat: incoming message origin validation for ios#476
Conversation
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
| /// | ||
| /// Entries are origin patterns: | ||
| /// - `"https://example.com"` — an exact origin. | ||
| /// - `"https://*.example.com"` — any subdomain of `example.com`. |
There was a problem hiding this comment.
These are public Swift API additions, but I could not find the matching API baseline update. Could we refresh platforms/swift/api/ShopifyCheckoutKit.json so the API check stays green?
|
|
||
| var host = authority | ||
| var port: Int? | ||
| if let colon = authority.lastIndex(of: ":") { |
There was a problem hiding this comment.
I think IPv6 origins can fail here: this parser keeps the brackets, while URL.host and WKSecurityOrigin.host remove them. Could we make the parsing and serialization bracket-aware and add default- and explicit-port IPv6 tests?
| @@ -465,6 +476,15 @@ extension CheckoutWebView: WKScriptMessageHandler { | |||
| return | |||
There was a problem hiding this comment.
Could we also check message.frameInfo.isMainFrame here? Swift currently accepts child-frame messages, while Web and Android require the main checkout frame. A regression test would help keep the platforms aligned.
2 participants
What changes are you making?
How to test
Before you merge
Important
platforms/swift/README.mdand/orplatforms/android/README.md)Releasing a new Swift version?
ShopifyCheckoutKit.podspecplatforms/swift/Sources/ShopifyCheckoutKit/ShopifyCheckoutKit.swiftplatforms/swift/README.md(major version only)Releasing a new Embedded Checkout Protocol version?
embeddedCheckoutProtocolAndroidinplatforms/android/gradle/libs.versions.tomlprotocol/languages/kotlin/embedded-checkout-protocol/api/embedded-checkout-protocol.apiif the public API changedReleasing a new Android version?
checkoutKitAndroidinplatforms/android/gradle/libs.versions.tomlplatforms/android/README.mdTip
See the Contributing documentation for the full release process per platform.