Security issure with HTML5: Overly Permissive Message Posting Policy (PostMessage Broadcast Vulnerability) in vuelayers

[jerry1108]

dear @ghettovoice :
I have developed GIS Web application by using vuelayers (@Version 0.11.5-beta.3) and recently the application has been scanned by third party security-testing tools in our customer production environment. One of security vulnerabilities is HTML5: Overly Permissive Message Posting Policy (PostMessage Broadcast Vulnerability) that is found in row 57995 in vuelayes.js:
_global.postMessage(id + '', '*');

The suggestion of the report is avoiding to use * as postMessage's parameter (targetOrigin).
Can I modify * to something else? ex: our application domain name? or...?
How do I fix this vulnerability?
Hope you can give me a hint or suggestion. Thank you.

[become-iron]

This problem could relate to core-js@2 which is being used by vuelayers: https://github.com/zloirock/core-js/blob/v2/modules/_task.js#L59-L65. And it seems that core-js@3 makes thing in other way: https://github.com/zloirock/core-js/blob/v3/packages/core-js/internals/task.js#L77-L81. So building of vuelayers with core-js@3 may help you, I think?

[ghettovoice]

Hello @jerry1108 ,
I guess you are using UMD version of the lib, so as temporary workaround you can replace '*' with some domain. With the next release I think I can switch vuelayers to use @babel/runtime-corejs3,so the issue should gone.

Or before the release, as @become-iron suggested, fork and build with @babel/runtime-corejs3 yourself.

Thanks for report!

[jerry1108]

@become-iron , @ghettovoice :
thank you very much.

[ghettovoice]

Done in v0.11.21