fix(broadcast): cross-window communication with unrestricted target origin

[ptrgits]

WebClients/packages/shared/lib/broadcast/broadcast.ts

Line 54 in a832ce2

window.parent.postMessage(serialized, '*');

The window.postMessage method allows different windows or iframes to communicate directly, even if they were loaded from different origins, circumventing the usual same-origin policy. The sender of the message can restrict the origin of the receiver by specifying a target origin. If the receiver window does not come from this origin, the message is not sent.

Alternatively, the sender can specify a target origin of '*', which means that any origin is acceptable and the message is always sent. This feature should not be used if the message being sent contains sensitive data such as user credentials: the target window may have been loaded from a malicious site, to which the data would then become available.

fix the problem, we need to restrict the target origin in the window.parent.postMessage call in packages/shared/lib/broadcast/broadcast.ts (line 54). Instead of using '*', we should specify the expected parent window's origin. The best way to do this is to pass the trusted origin as an argument to the broadcast function, or to determine it from configuration or environment variables. Since we can only edit the code shown, the simplest and safest fix is to replace '*' with a hardcoded trusted origin (e.g., 'https://account.proton.me'), assuming this is the only allowed embedding parent. If the parent origin can vary, the code should be updated to accept the origin as a parameter, but this would require changes outside the shown code.

Required changes:

• In packages/shared/lib/broadcast/broadcast.ts, replace '*' with the trusted origin string in the window.parent.postMessage call.
• If the trusted origin is not known, use a placeholder and add a comment to update it as needed.

References

Window.postMessage
Same-origin policy
CWE-201
CWE-359