Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: modelcontextprotocol/ext-apps
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: modelcontextprotocol/ext-apps
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: refs/pull/207/head
Choose a head ref
  • 4 commits
  • 3 files changed
  • 2 contributors

Commits on Jan 7, 2026

  1. fix(app): add source validation to default PostMessageTransport 

    App.connect() now passes window.parent as both eventTarget and eventSource,
enabling source validation by default. This ensures apps only accept
messages from their parent window, preventing potential cross-app
message spoofing attacks.

Previously, the default transport only specified the target but not the
source for validation, meaning apps would accept messages from ANY window.
    @ochafik
    ochafik committed Jan 7, 2026
    Configuration menu
    Copy the full SHA
    e3c01ae View commit details
    Browse the repository at this point in the history

  2. fix(sandbox): add origin validation for host messages 

    The sandbox proxy now validates that messages from the parent window
come from the expected host origin (derived from document.referrer).
This prevents malicious pages from sending spoofed messages to the sandbox.

Changes:
- Extract EXPECTED_HOST_ORIGIN from document.referrer
- Validate event.origin against expected origin for parent messages
- Use specific origin instead of '*' when sending to parent
- Reject and log messages from unexpected origins

This addresses the TODO comment that was previously in the code.
    @ochafik
    ochafik committed Jan 7, 2026
    Configuration menu
    Copy the full SHA
    507fbbf View commit details
    Browse the repository at this point in the history

  3. validate messages from app come from same origin as sandbox proxy

    @ochafik
    ochafik committed Jan 7, 2026
    Configuration menu
    Copy the full SHA
    f99592f View commit details
    Browse the repository at this point in the history

  4. fix(basic-host): be resilient to individual server connection failures 

    Use Promise.allSettled instead of Promise.all when connecting to
servers, so that a single server failure doesn't crash the entire UI.
Failed connections are logged as warnings but the UI continues with
the servers that connected successfully.

Also fixes video-resource-server missing server-utils.ts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
    @ochafik @claude
    ochafik and claude committed Jan 7, 2026
    Configuration menu
    Copy the full SHA
    1cc0e16 View commit details
    Browse the repository at this point in the history
Loading