prevent XSS for app.html

live-codes · Aug 15, 2023 · 36362d8 · 36362d8
1 parent 2949ccd
commit 36362d8
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/livecodes/html/app-base.html b/src/livecodes/html/app-base.html
@@ -7,7 +7,11 @@
     <title>LiveCodes</title>
     <script>
       window.addEventListener('message', function (event) {
-        if (event.data.content) {
+        if (
+          event.origin === window.location.origin &&
+          event.source === parent &&
+          event.data.content
+        ) {
           document.write(event.data.content);
           document.close();
         }