@amplifyup/sdk 0.1.9 → 0.1.10

package/dist/react.js

@@ -1083,6 +1083,39 @@ Available Console Commands:
       this.attachEventListeners();
     }
   }
+  /** Origins allowed to send Composer postMessage commands to the SDK. */
+  isAllowedComposerOrigin(origin) {
+    if (typeof window === "undefined") return false;
+    if (origin === window.location.origin) return true;
+    const staticAllowed = [
+      "http://localhost:5001",
+      "http://localhost:3001",
+      "https://amplifyup.ai",
+      "https://orchestrator.amplifyup.com"
+    ];
+    if (staticAllowed.includes(origin)) return true;
+    try {
+      const host = new URL(origin).hostname;
+      if (host === "amplifyup.ai" || host.endsWith(".amplifyup.ai")) return true;
+    } catch {
+    }
+    const orchestratorFromQuery = (() => {
+      try {
+        const value = new URLSearchParams(window.location.search).get("orchestratorUrl");
+        return value ? new URL(value).origin : null;
+      } catch {
+        return null;
+      }
+    })();
+    if (orchestratorFromQuery && origin === orchestratorFromQuery) return true;
+    if (this.orchestratorUrl) {
+      try {
+        if (new URL(this.orchestratorUrl).origin === origin) return true;
+      } catch {
+      }
+    }
+    return false;
+  }
   /**
    * Set up postMessage listener for highlighting commands from orchestrator
    */
@@ -1098,18 +1131,10 @@ Available Console Commands:
         currentOrigin: window.location.origin,
         data: event.data
       });
-      const allowedOrigins = [
-        "http://localhost:5001",
-        "http://localhost:3001",
-        "https://orchestrator.amplifyup.com"
-      ];
-      const isSameOrigin = event.origin === window.location.origin;
-      const isAllowedOrigin = allowedOrigins.some((origin) => event.origin.startsWith(origin));
-      if (!isSameOrigin && !isAllowedOrigin) {
+      if (!this.isAllowedComposerOrigin(event.origin)) {
         console.warn("[AmplifyUp SDK] Rejected message from unauthorized origin:", {
           eventOrigin: event.origin,
-          currentOrigin: window.location.origin,
-          allowedOrigins
+          currentOrigin: window.location.origin
         });
         return;
       }