Merge branch 'develop' into fix/missing-postmessage-validation

2026-04-29 17:27:16 +05:30 · 2026-04-24 16:15:00 +05:30 · 2026-04-23 18:22:15 +05:30 · 2026-01-21 13:42:18 +05:30 · 2026-01-15 11:38:30 +05:30 · 2026-01-12 16:34:13 +05:30
1 changed files with 20 additions and 1 deletions
@@ -42,6 +42,19 @@ const updateAuthCookie = (cookieContent, baseDomain = '') =>
    baseDomain,
  });

+const getTargetOrigin = () => {
+  const { baseUrl } = window.$chatwoot || {};
+  if (!baseUrl) {
+    return window.location.origin;
+  }
+  try {
+    const url = new URL(baseUrl);
+    return url.origin;
+  } catch {
+    return window.location.origin;
+  }
+};
+
 const updateCampaignReadStatus = baseDomain => {
  const expireBy = addHours(new Date(), 1);
  setCookieWithDomain('cw_snooze_campaigns_till', Number(expireBy), {
@@ -93,13 +106,19 @@ export const IFrameHelper = {
  getBubbleHolder: () => document.getElementsByClassName('woot--bubble-holder'),
  sendMessage: (key, value) => {
    const element = IFrameHelper.getAppFrame();
+    const targetOrigin = getTargetOrigin();
+    if (!targetOrigin) return;
    element.contentWindow.postMessage(
      `chatwoot-widget:${JSON.stringify({ event: key, ...value })}`,
-      '*'
+      targetOrigin
    );
  },
  initPostMessageCommunication: () => {
    window.onmessage = e => {
+      const expectedOrigin = getTargetOrigin();
+      if (!expectedOrigin || e.origin !== expectedOrigin) {
+        return;
+      }
      if (
        typeof e.data !== 'string' ||
        e.data.indexOf('chatwoot-widget:') !== 0
Author	SHA1	Message	Date
Vishnu NarayananandGitHub	8b759496f2	Merge branch 'develop' into fix/missing-postmessage-validation	2026-04-29 17:27:16 +05:30
Vishnu NarayananandGitHub	98fa5f60e9	Merge branch 'develop' into fix/missing-postmessage-validation	2026-04-24 16:15:00 +05:30
Vishnu NarayananandGitHub	7a8829e79e	Merge branch 'develop' into fix/missing-postmessage-validation	2026-04-23 18:22:15 +05:30
Shivam MishraandGitHub	bf397750f3	Merge branch 'develop' into fix/missing-postmessage-validation	2026-01-21 13:42:18 +05:30
Vinay KeerthiandGitHub	f253ea0abc	Merge branch 'develop' into fix/missing-postmessage-validation	2026-01-15 11:38:30 +05:30
Vinay Keerthi	3aea425abc	fix: handle same-origin deployments in postMessage validation Fall back to window.location.origin when baseUrl is empty or relative, supporting same-origin deployments while maintaining origin validation.	2026-01-12 16:34:13 +05:30
Vinay Keerthi	eee307b36b	fix: add postMessage origin validation in widget SDK Adds origin validation for postMessage communication in the widget SDK: - Extract and validate origin from configured baseUrl - Use specific target origin instead of wildcard when sending messages - Validate sender origin when receiving messages Fixes: CW-6301	2026-01-12 16:27:52 +05:30