Skip to content

fix!: require eventSource in PostMessageTransport + add security tests #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ochafik merged 6 commits into from
Jan 7, 2026
+433 −2
Merged

fix!: require eventSource in PostMessageTransport + add security tests #208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
92a5376
test: add E2E security tests for origin validation
ochafik Jan 7, 2026
1aaff83
test: add E2E security tests for origin validation
ochafik Jan 7, 2026
20ddee0
fix(test): match actual host log message format
ochafik Jan 7, 2026
1a94ba4
test: add cross-app message injection protection test
ochafik Jan 7, 2026
4f7581a
test: fix origin validation test to actually verify rejection
ochafik Jan 7, 2026
27067ce
test: fix origin validation test to verify cross-origin boundary
ochafik Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/message-transport.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ export class PostMessageTransport implements Transport {
*/
constructor(
private eventTarget: Window = window.parent,
private eventSource?: MessageEventSource,
private eventSource: MessageEventSource,
) {
this.messageListener = (event) => {
if (eventSource && event.source !== this.eventSource) {
Expand Down
5 changes: 4 additions & 1 deletion src/react/useApp.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,10 @@ export function useApp({

async function connect() {
try {
const transport = new PostMessageTransport(window.parent);
const transport = new PostMessageTransport(
window.parent,
window.parent,
);
const app = new App(appInfo, capabilities);

// Register handlers BEFORE connecting
Expand Down
Loading
Loading