From 3adb2dbcf1ad62f6f159f32200292507a0a20ce1 Mon Sep 17 00:00:00 2001 From: Jaynel Patiarba Date: Mon, 1 Jun 2026 22:00:59 +0800 Subject: [PATCH] fix(admin): add postMessage origin validation to liveControls.ts Align liveControls.ts with LiveControls.tsx by adding TRUSTED_ORIGINS allowlist and isTrustedOrigin() check. Without this, any page that iframes the storefront can execute arbitrary JS via postMessage. Co-Authored-By: Claude Opus 4.6 (1M context) --- src/admin/liveControls.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/admin/liveControls.ts b/src/admin/liveControls.ts index d8f18870..aa05d951 100644 --- a/src/admin/liveControls.ts +++ b/src/admin/liveControls.ts @@ -14,7 +14,16 @@ export const LIVE_CONTROLS_SCRIPT = ` if (window.__DECO_LIVE_CONTROLS__) return; window.__DECO_LIVE_CONTROLS__ = true; + var TRUSTED_ORIGINS = ["https://deco.cx", "https://admin.deco.cx", "https://play.deco.cx"]; + function isTrustedOrigin(origin) { + return TRUSTED_ORIGINS.indexOf(origin) !== -1 || + (origin.startsWith("https://") && origin.endsWith(".deco.cx")) || + origin === window.location.origin; + } + addEventListener("message", function(event) { + if (!isTrustedOrigin(event.origin)) return; + var data = event.data; if (!data || typeof data !== "object") return; switch (data.type) {