From 4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09 Mon Sep 17 00:00:00 2001 From: Rohan Sharma Date: Tue, 1 Feb 2022 22:04:48 +0530 Subject: [PATCH] Fixed prototype pollution bug and only allow trusted origin (#17420) --- public/embed.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/embed.js b/public/embed.js index dac507453..d597fd33c 100644 --- a/public/embed.js +++ b/public/embed.js @@ -15,7 +15,7 @@ window.addEventListener('message', function(e) { var data = e.data || {}; - if (data.type !== 'setHeight' || !iframes[data.id]) { + if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') { return; }