fix: adding url check to iframe _message

kyxyes · Oct 13, 2020 · e8bd1b2 · e8bd1b2
1 parent 2e5e28b
commit e8bd1b2
Show file tree

Hide file tree

Showing 12 changed files with 19 additions and 18 deletions.
diff --git a/dist/oidc-client.js b/dist/oidc-client.js
diff --git a/dist/oidc-client.min.js b/dist/oidc-client.min.js
diff --git a/dist/oidc-client.rsa256.slim.js b/dist/oidc-client.rsa256.slim.js
diff --git a/dist/oidc-client.rsa256.slim.min.js b/dist/oidc-client.rsa256.slim.min.js
diff --git a/dist/oidc-client.slim.js b/dist/oidc-client.slim.js
diff --git a/dist/oidc-client.slim.min.js b/dist/oidc-client.slim.min.js
diff --git a/lib/oidc-client.js b/lib/oidc-client.js
diff --git a/lib/oidc-client.min.js b/lib/oidc-client.min.js
diff --git a/lib/oidc-client.rsa256.js b/lib/oidc-client.rsa256.js
diff --git a/lib/oidc-client.rsa256.min.js b/lib/oidc-client.rsa256.min.js
diff --git a/package-lock.json b/package-lock.json
diff --git a/src/IFrameWindow.js b/src/IFrameWindow.js
@@ -86,7 +86,8 @@ export class IFrameWindow {
 
         if (this._timer &&
             e.origin === this._origin &&
-            e.source === this._frame.contentWindow
+            e.source === this._frame.contentWindow &&
+            (e.data.startsWith('http://') || e.data.startsWith('https://'))
         ) {
             let url = e.data;
             if (url) {