]> cat aescling's git repositories - mastodon.git/commit
cat aescling's git repositories / mastodon.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7bdb366) | patch
fix: embed.js doesn't expands iframes height (#18301)
authorrinsuki <428rinsuki+git@gmail.com>
Wed, 4 May 2022 01:20:44 +0000 (10:20 +0900)
committersingle-right-quote <11325618-aescling@users.noreply.gitlab.com>
Thu, 5 May 2022 17:49:38 +0000 (13:49 -0400)
commitfb716ac45b5a177f06c7595838ce74c268c14377
tree9b110010724156ce328db984c4aa3fc6b23a27e8tree | snapshot
parent7bdb366eb39f68537b03257ea162b1b96adfa73fcommit | diff
fix: embed.js doesn't expands iframes height (#18301)

also including some refactoring:
- add `// @ts-check`
- use Map to completely avoid prototype pollution
- assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts
- check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec)

follow-up of #17420
fix #18299
public/embed.js diff | blob | history
source code fur Kibicat Mastodon