Skip to content
This repository has been archived by the owner. It is now read-only.

Mozfreddyb patch 1 #79

Merged
merged 2 commits into from Sep 13, 2019
Merged

Mozfreddyb patch 1 #79

merged 2 commits into from Sep 13, 2019

Conversation

Reviewers

@kenmickles kenmickles

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
@dtoakley @kenmickles @mozfreddyb
@dtoakley
Copy link
Member

@dtoakley dtoakley commented Sep 13, 2019 •
edited

This updates the checks for event origin and linkUrl to support all browser, using String.prototype.lastIndexOf.
mozfreddyb and others added 2 commits Sep 13, 2019
@mozfreddyb
Fix XSS and spoofing issues
1e81fb4 
This patch ensures that the message event comes from the iframe and nobody else.
Further it ensures that navigation triggered by message passing actually navigates to another website and does not allow `javascript` URLs which is a Cross-Site-Scripting vulnerabilities
@dtoakley
updated checks for event origin and linkUrl to support all browser
9a872db
@dtoakley dtoakley mentioned this pull request Sep 13, 2019
Closed
@dtoakley dtoakley requested a review from kenmickles Sep 13, 2019
@kenmickles
Copy link
Member

@kenmickles kenmickles commented Sep 13, 2019

👍

@kenmickles kenmickles merged commit 53b20f4 into master Sep 13, 2019
2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.