chore: ensure the origin is checked in the tooling test app, creator …

…and component explorer (microsoft#3475)
vnextcoder · Jul 10, 2020 · ecfcc75 · ecfcc75
1 parent 2b9c9ec
commit ecfcc75
Show file tree

Hide file tree

Showing 4 changed files with 99 additions and 95 deletions.
diff --git a/packages/tooling/fast-tooling-react/app/pages/viewer/content.tsx b/packages/tooling/fast-tooling-react/app/pages/viewer/content.tsx
@@ -38,7 +38,7 @@ class ViewerContent extends React.Component<{}, ViewerContentState> {
     };
 
     private handlePostMessage = (e: MessageEvent): void => {
-        if (typeof e.data === "string") {
+        if (e.origin === location.origin && typeof e.data === "string") {
             try {
                 this.setState({
                     message: JSON.stringify(JSON.parse(e.data), null, 2),

diff --git a/...ages/tooling/fast-tooling-react/app/pages/web-components/web-component-viewer-content.tsx b/...ages/tooling/fast-tooling-react/app/pages/web-components/web-component-viewer-content.tsx
@@ -49,7 +49,7 @@ class WebComponentViewerContent extends React.Component<
     }
 
     private handlePostMessage = (e: MessageEvent): void => {
-        if (typeof e.data === "string") {
+        if (e.origin === location.origin && typeof e.data === "string") {
             try {
                 const parsedJSON = JSON.parse(e.data);
 

diff --git a/sites/fast-component-explorer/app/preview.tsx b/sites/fast-component-explorer/app/preview.tsx
@@ -99,61 +99,63 @@ class Preview extends Foundation<
     }
 
     private handleMessage = (message: MessageEvent): void => {
-        let messageData: unknown;
-
-        try {
-            messageData = JSON.parse(message.data);
-
-            /* eslint-disable-next-line no-empty */
-        } catch (e) {}
-
-        if (messageData !== undefined) {
-            switch ((messageData as MessageSystemOutgoing).type) {
-                case MessageSystemType.initialize:
-                    this.setState(
-                        {
-                            dataDictionary: (messageData as InitializeMessageOutgoing)
-                                .dataDictionary,
-                            schemaDictionary: (messageData as InitializeMessageOutgoing)
-                                .schemaDictionary,
-                        },
-                        this.attachMappedComponents
-                    );
-                    break;
-                case MessageSystemType.data:
-                    this.setState(
-                        {
-                            dataDictionary: (messageData as DataMessageOutgoing)
-                                .dataDictionary,
-                        },
-                        this.attachMappedComponents
-                    );
-                    break;
-                case MessageSystemType.custom:
-                    if ((messageData as any).id === previewBackgroundTransparency) {
-                        this.setState(
-                            {
-                                transparentBackground: (messageData as any).value,
-                            },
-                            this.attachMappedComponents
-                        );
-                    } else if ((messageData as any).id === previewDirection) {
+        if (message.origin === location.origin) {
+            let messageData: unknown;
+
+            try {
+                messageData = JSON.parse(message.data);
+
+                /* eslint-disable-next-line no-empty */
+            } catch (e) {}
+
+            if (messageData !== undefined) {
+                switch ((messageData as MessageSystemOutgoing).type) {
+                    case MessageSystemType.initialize:
                         this.setState(
                             {
-                                direction: (messageData as any).value,
+                                dataDictionary: (messageData as InitializeMessageOutgoing)
+                                    .dataDictionary,
+                                schemaDictionary: (messageData as InitializeMessageOutgoing)
+                                    .schemaDictionary,
                             },
                             this.attachMappedComponents
                         );
-                    } else if ((messageData as any).id === previewTheme) {
+                        break;
+                    case MessageSystemType.data:
                         this.setState(
                             {
-                                theme: (messageData as any).value,
+                                dataDictionary: (messageData as DataMessageOutgoing)
+                                    .dataDictionary,
                             },
                             this.attachMappedComponents
                         );
-                    }
-
-                    break;
+                        break;
+                    case MessageSystemType.custom:
+                        if ((messageData as any).id === previewBackgroundTransparency) {
+                            this.setState(
+                                {
+                                    transparentBackground: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        } else if ((messageData as any).id === previewDirection) {
+                            this.setState(
+                                {
+                                    direction: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        } else if ((messageData as any).id === previewTheme) {
+                            this.setState(
+                                {
+                                    theme: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        }
+
+                        break;
+                }
             }
         }
     };

diff --git a/sites/fast-creator/app/preview.tsx b/sites/fast-creator/app/preview.tsx
@@ -163,71 +163,73 @@ class Preview extends Foundation<{}, {}, PreviewState> {
     }
 
     private handleMessage = (message: MessageEvent): void => {
-        let messageData: unknown;
+        if (message.origin === location.origin) {
+            let messageData: unknown;
 
-        try {
-            messageData = JSON.parse(message.data);
-        } catch (e) {
-            return;
-        }
+            try {
+                messageData = JSON.parse(message.data);
+            } catch (e) {
+                return;
+            }
 
-        if (messageData !== undefined) {
-            switch ((messageData as MessageSystemOutgoing).type) {
-                case MessageSystemType.initialize:
-                    this.setState(
-                        {
-                            dataDictionary: (messageData as InitializeMessageOutgoing)
-                                .dataDictionary,
-                            schemaDictionary: (messageData as InitializeMessageOutgoing)
-                                .schemaDictionary,
-                            activeDictionaryId: (messageData as InitializeMessageOutgoing)
-                                .activeDictionaryId,
-                        },
-                        this.attachMappedComponents
-                    );
-                    break;
-                case MessageSystemType.data:
-                    this.setState(
-                        {
-                            dataDictionary: (messageData as DataMessageOutgoing)
-                                .dataDictionary,
-                        },
-                        this.attachMappedComponents
-                    );
-                    break;
-                case MessageSystemType.navigation:
-                    this.setState(
-                        {
-                            activeDictionaryId: (messageData as NavigationMessageOutgoing)
-                                .activeDictionaryId,
-                        },
-                        this.attachMappedComponents
-                    );
-                    break;
-                case MessageSystemType.custom:
-                    if ((messageData as any).id === previewDirection) {
+            if (messageData !== undefined) {
+                switch ((messageData as MessageSystemOutgoing).type) {
+                    case MessageSystemType.initialize:
                         this.setState(
                             {
-                                direction: (messageData as any).value,
+                                dataDictionary: (messageData as InitializeMessageOutgoing)
+                                    .dataDictionary,
+                                schemaDictionary: (messageData as InitializeMessageOutgoing)
+                                    .schemaDictionary,
+                                activeDictionaryId: (messageData as InitializeMessageOutgoing)
+                                    .activeDictionaryId,
                             },
                             this.attachMappedComponents
                         );
-                    } else if ((messageData as any).id === previewAccentColor) {
+                        break;
+                    case MessageSystemType.data:
                         this.setState(
                             {
-                                accentColor: (messageData as any).value,
+                                dataDictionary: (messageData as DataMessageOutgoing)
+                                    .dataDictionary,
                             },
                             this.attachMappedComponents
                         );
-                    } else if ((messageData as any).id === previewTheme) {
+                        break;
+                    case MessageSystemType.navigation:
                         this.setState(
                             {
-                                theme: (messageData as any).value,
+                                activeDictionaryId: (messageData as NavigationMessageOutgoing)
+                                    .activeDictionaryId,
                             },
                             this.attachMappedComponents
                         );
-                    }
-                    break;
+                        break;
+                    case MessageSystemType.custom:
+                        if ((messageData as any).id === previewDirection) {
+                            this.setState(
+                                {
+                                    direction: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        } else if ((messageData as any).id === previewAccentColor) {
+                            this.setState(
+                                {
+                                    accentColor: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        } else if ((messageData as any).id === previewTheme) {
+                            this.setState(
+                                {
+                                    theme: (messageData as any).value,
+                                },
+                                this.attachMappedComponents
+                            );
+                        }
+                        break;
+                }
             }
         }
     };