fix: validate origin and avoid innerHTML in tettst.html postMessage handler - #129
Open
hacktron-app-stg[bot] wants to merge 1 commit into
Open
fix: validate origin and avoid innerHTML in tettst.html postMessage handler#129hacktron-app-stg[bot] wants to merge 1 commit into
hacktron-app-stg[bot] wants to merge 1 commit into
Conversation
…andler The message listener accepted postMessage from any origin and wrote the untrusted event.data payload into innerHTML, enabling DOM-based XSS. Add a strict origin allow-list that drops untrusted senders and render received data with textContent instead of innerHTML so payloads cannot execute.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
tettst.htmladded amessageevent listener that was DOM-XSS vulnerable:event.originbut never validated it, so it acceptedpostMessagefrom any origin.event.datapayload was assigned directly todocument.getElementById('output').innerHTML, executing embedded markup/scripts (e.g.<img src=x onerror=alert(...)>).An attacker page could open this page and
postMessagea malicious HTML payload to run arbitrary JS in the victim page's context.Fix
ALLOWED_ORIGINSallow-list (defaulting towindow.location.origin) and an earlyreturnwhenevent.originis not allowed, closing the missing-origin-validation root cause.innerHTMLsink withtextContent, so any received data is rendered as inert text rather than parsed as HTML — this alone defeats the XSS even for same-origin messages.Why it's correct
Both layers of the taint path are addressed: attacker-controlled cross-origin messages are dropped before reaching the sink, and the sink itself no longer interprets HTML. There are no other callers/usages of the changed listener (single self-contained file).
Verification
innerHTMLis fully removed and replaced withtextContent, and the origin guard uses!ALLOWED_ORIGINS.has(event.origin)(correct polarity).event.originguard blocks untrusted senders;textContentprevents markup execution even if a message passes the guard.Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/a65c812f-30a3-4588-86fa-a31804081168