@chordcommerce/analytics 1.22.0 → 1.22.1-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/client/index.js +3 -2
- package/dist/client/index.js +3 -2
- package/package.json +1 -1
package/dist/cjs/client/index.js
CHANGED
|
@@ -824,9 +824,10 @@ var ChordAnalytics = /** @class */ (function () {
|
|
|
824
824
|
return;
|
|
825
825
|
if (event.data.source !== 'chord-web-pixel')
|
|
826
826
|
return;
|
|
827
|
-
// Validate origin — only accept messages from the same hostname
|
|
827
|
+
// Validate origin — only accept messages from the same hostname or from
|
|
828
|
+
// null-origin sandboxed iframes (Shopify web pixel sandbox has origin "null")
|
|
828
829
|
try {
|
|
829
|
-
if (event.origin) {
|
|
830
|
+
if (event.origin && event.origin !== 'null') {
|
|
830
831
|
var eventHostname = new URL(event.origin).hostname;
|
|
831
832
|
if (eventHostname !== window.location.hostname)
|
|
832
833
|
return;
|
package/dist/client/index.js
CHANGED
|
@@ -653,9 +653,10 @@ export class ChordAnalytics {
|
|
|
653
653
|
return;
|
|
654
654
|
if (event.data.source !== 'chord-web-pixel')
|
|
655
655
|
return;
|
|
656
|
-
// Validate origin — only accept messages from the same hostname
|
|
656
|
+
// Validate origin — only accept messages from the same hostname or from
|
|
657
|
+
// null-origin sandboxed iframes (Shopify web pixel sandbox has origin "null")
|
|
657
658
|
try {
|
|
658
|
-
if (event.origin) {
|
|
659
|
+
if (event.origin && event.origin !== 'null') {
|
|
659
660
|
const eventHostname = new URL(event.origin).hostname;
|
|
660
661
|
if (eventHostname !== window.location.hostname)
|
|
661
662
|
return;
|
package/package.json
CHANGED