feat: ignore messages from different origin and sanitize URLs

app/javascript/sdk/IFrameHelper.js

@@ -74,9 +74,12 @@ const sanitizeURL = url => {
 
 export const IFrameHelper = {
   getUrl({ baseUrl, websiteToken }) {
+    baseUrl = sanitizeURL(baseUrl);
     return `${baseUrl}/widget?website_token=${websiteToken}`;
   },
   createFrame: ({ baseUrl, websiteToken }) => {
+    baseUrl = sanitizeURL(baseUrl);
+
     if (IFrameHelper.getAppFrame()) {
       return;
     }
@@ -124,10 +127,12 @@ export const IFrameHelper = {
     window.onmessage = e => {
       if (
         typeof e.data !== 'string' ||
-        e.data.indexOf('chatwoot-widget:') !== 0
+        e.data.indexOf('chatwoot-widget:') !== 0 ||
+        e.origin !== window.location.origin
       ) {
         return;
       }
+
       const message = JSON.parse(e.data.replace('chatwoot-widget:', ''));
       if (typeof IFrameHelper.events[message.event] === 'function') {
         IFrameHelper.events[message.event](message);
@@ -162,7 +167,9 @@ export const IFrameHelper = {
   },
 
   setupAudioListeners: () => {
-    const { baseUrl = '' } = window.$chatwoot;
+    let { baseUrl = '' } = window.$chatwoot;
+    baseUrl = sanitizeURL(baseUrl);
+
     getAlertAudio(baseUrl, { type: 'widget', alertTone: 'ding' }).then(() =>
       initOnEvents.forEach(event => {
         document.removeEventListener(
@@ -256,6 +263,7 @@ export const IFrameHelper = {
     },
 
     popoutChatWindow: ({ baseUrl, websiteToken, locale }) => {
+      baseUrl = sanitizeURL(baseUrl);
       const cwCookie = Cookies.get('cw_conversation');
       window.$chatwoot.toggle('close');
       popoutChatWindow(baseUrl, websiteToken, locale, cwCookie);