Merge pull request IdentityModel#1223 from paulmowat/fix/postMessageU…

…rlCheck IFrameWindow.js _message url checks
chrisgbaker · Jan 28, 2021 · 202a057 · 202a057
2 parents f0c08c5 + c8f45fb
commit 202a057
Show file tree

Hide file tree

Showing 11 changed files with 18 additions and 17 deletions.
diff --git a/dist/oidc-client.js b/dist/oidc-client.js
diff --git a/dist/oidc-client.min.js b/dist/oidc-client.min.js
diff --git a/dist/oidc-client.rsa256.slim.js b/dist/oidc-client.rsa256.slim.js
diff --git a/dist/oidc-client.rsa256.slim.min.js b/dist/oidc-client.rsa256.slim.min.js
diff --git a/dist/oidc-client.slim.js b/dist/oidc-client.slim.js
diff --git a/dist/oidc-client.slim.min.js b/dist/oidc-client.slim.min.js
diff --git a/lib/oidc-client.js b/lib/oidc-client.js
diff --git a/lib/oidc-client.min.js b/lib/oidc-client.min.js
diff --git a/lib/oidc-client.rsa256.js b/lib/oidc-client.rsa256.js
diff --git a/lib/oidc-client.rsa256.min.js b/lib/oidc-client.rsa256.min.js
diff --git a/src/IFrameWindow.js b/src/IFrameWindow.js
@@ -86,7 +86,8 @@ export class IFrameWindow {
 
         if (this._timer &&
             e.origin === this._origin &&
-            e.source === this._frame.contentWindow
+            e.source === this._frame.contentWindow &&
+            (typeof e.data === 'string' && (e.data.startsWith('http://') || e.data.startsWith('https://')))
         ) {
             let url = e.data;
             if (url) {