mirror/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon synced 2024-11-27 14:28:24 +09:00
Code

Fixed prototype pollution bug and only allow trusted origin (#17420)

Browse Source
This commit is contained in:
Rohan Sharma 2022-02-01 22:04:48 +05:30 committed by GitHub
parent 54581d43e7
commit 4d6d4b43c6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/embed.js
View File

@ -15,7 +15,7 @@
window.addEventListener('message', function(e) {
var data = e.data || {};
if (data.type !== 'setHeight' || !iframes[data.id]) {
if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
return;
}