window.addEventListener('message') should verify the message origin

[jchayan]

I notice you are using the postMessage API for cross-origin communication. In my application there are other programs implementing this as well, which causes these messages to enter in your event listener (relay.js:28: events.bind(window, 'message', listener)).

In my use case, I'm receiving strings via postMessage, which causes relay.js:29: var data = JSON.parse(event.data) to fail. There should exist origin checking in order to avoid conflicts, e.g:

events.bind(window, 'message', function listener (event) {
    if (event.origin === 'https://api.recurly.com') { /* or whatever property that holds this value */
        var data = JSON.parse(event.data);
        var name = data.recurly_event;
        var body = data.recurly_message;
        var err = body.error ? errors('api-error', body.error) : null;
        events.unbind(window, 'message', listener);
        if (name) self.emit(name, err, body);
        if (frame) document.body.removeChild(frame);
    }
});

[jchayan]

I can merge the fix for this

[jchayan]

@chrissrogers This should be closed :)