@dynamic-labs-wallet/browser-wallet-client 1.0.82 → 1.0.84

package/index.cjs

@@ -246,6 +246,23 @@ class IframeMessageHandler {
 
 const logger = new logger$1.Logger('DynamicWaasWalletClient');
 
+const isOpaqueOrigin = (origin)=>!origin || origin === '' || origin === 'null';
+const isNativeBridgeEvent = (event)=>event.source === null && isOpaqueOrigin(event.origin);
+/**
+ * Validate the browser-supplied `origin` and `source` of an incoming message.
+ * Native WebView bridge events have an opaque origin and a null source.
+ * Messages from the iframe must come from the iframe's contentWindow and
+ * declare the iframe's origin.
+ *
+ * TODO: replace with `@dynamic-labs/message-transport/isMessageEventTrusted`
+ * once the wallet client is on a version that exports it.
+ */ const isTrustedIncomingMessage = (event, source, iframe, iframeOrigin)=>{
+    if (source === 'document') {
+        return isNativeBridgeEvent(event);
+    }
+    const isFromIframe = event.source === iframe.contentWindow && event.origin === iframeOrigin;
+    return isFromIframe || isNativeBridgeEvent(event);
+};
 const setupMessageTransportBridge = (messageTransport$1, iframe, iframeOrigin)=>{
     const logger = new logger$1.Logger('debug');
     function hostListener(message) {
@@ -267,15 +284,19 @@ const setupMessageTransportBridge = (messageTransport$1, iframe, iframeOrigin)=>
         }
     }
     messageTransport$1.on(hostListener);
-    const handleIncomingMessage = (message)=>{
-        const { data } = message;
-        if (!data) return;
-        if ((data == null ? void 0 : data.origin) !== 'webview') {
+    const handleIncomingMessage = (event, source)=>{
+        if (!isTrustedIncomingMessage(event, source, iframe, iframeOrigin)) {
+            logger.debug(`skipped message: untrusted ${source} event (origin: ${event.origin}, source mismatch)`);
             return;
         }
+        const { data } = event;
+        if (!data) return;
         if (typeof data !== 'object') {
             return;
         }
+        if ((data == null ? void 0 : data.origin) !== 'webview') {
+            return;
+        }
         try {
             const message = messageTransport.parseMessageTransportData(data);
             messageTransport$1.emit(message);
@@ -285,20 +306,22 @@ const setupMessageTransportBridge = (messageTransport$1, iframe, iframeOrigin)=>
             }
         }
     };
+    const handleDocumentMessage = (event)=>handleIncomingMessage(event, 'document');
+    const handleWindowMessage = (event)=>handleIncomingMessage(event, 'window');
     /**
    * Handle incoming message from android client
    */ // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-expect-error
-    document.addEventListener('message', handleIncomingMessage);
+    document.addEventListener('message', handleDocumentMessage);
     /**
    * Handle incoming message from iOS client
-   */ window.addEventListener('message', handleIncomingMessage);
+   */ window.addEventListener('message', handleWindowMessage);
     return ()=>{
         messageTransport$1.off(hostListener);
         // eslint-disable-next-line @typescript-eslint/ban-ts-comment
         // @ts-expect-error
-        document.removeEventListener('message', handleIncomingMessage);
-        window.removeEventListener('message', handleIncomingMessage);
+        document.removeEventListener('message', handleDocumentMessage);
+        window.removeEventListener('message', handleWindowMessage);
     };
 };
 

package/index.esm.js

@@ -245,6 +245,23 @@ class IframeMessageHandler {
 
 const logger = new Logger('DynamicWaasWalletClient');
 
+const isOpaqueOrigin = (origin)=>!origin || origin === '' || origin === 'null';
+const isNativeBridgeEvent = (event)=>event.source === null && isOpaqueOrigin(event.origin);
+/**
+ * Validate the browser-supplied `origin` and `source` of an incoming message.
+ * Native WebView bridge events have an opaque origin and a null source.
+ * Messages from the iframe must come from the iframe's contentWindow and
+ * declare the iframe's origin.
+ *
+ * TODO: replace with `@dynamic-labs/message-transport/isMessageEventTrusted`
+ * once the wallet client is on a version that exports it.
+ */ const isTrustedIncomingMessage = (event, source, iframe, iframeOrigin)=>{
+    if (source === 'document') {
+        return isNativeBridgeEvent(event);
+    }
+    const isFromIframe = event.source === iframe.contentWindow && event.origin === iframeOrigin;
+    return isFromIframe || isNativeBridgeEvent(event);
+};
 const setupMessageTransportBridge = (messageTransport, iframe, iframeOrigin)=>{
     const logger = new Logger('debug');
     function hostListener(message) {
@@ -266,15 +283,19 @@ const setupMessageTransportBridge = (messageTransport, iframe, iframeOrigin)=>{
         }
     }
     messageTransport.on(hostListener);
-    const handleIncomingMessage = (message)=>{
-        const { data } = message;
-        if (!data) return;
-        if ((data == null ? void 0 : data.origin) !== 'webview') {
+    const handleIncomingMessage = (event, source)=>{
+        if (!isTrustedIncomingMessage(event, source, iframe, iframeOrigin)) {
+            logger.debug(`skipped message: untrusted ${source} event (origin: ${event.origin}, source mismatch)`);
             return;
         }
+        const { data } = event;
+        if (!data) return;
         if (typeof data !== 'object') {
             return;
         }
+        if ((data == null ? void 0 : data.origin) !== 'webview') {
+            return;
+        }
         try {
             const message = parseMessageTransportData(data);
             messageTransport.emit(message);
@@ -284,20 +305,22 @@ const setupMessageTransportBridge = (messageTransport, iframe, iframeOrigin)=>{
             }
         }
     };
+    const handleDocumentMessage = (event)=>handleIncomingMessage(event, 'document');
+    const handleWindowMessage = (event)=>handleIncomingMessage(event, 'window');
     /**
    * Handle incoming message from android client
    */ // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-expect-error
-    document.addEventListener('message', handleIncomingMessage);
+    document.addEventListener('message', handleDocumentMessage);
     /**
    * Handle incoming message from iOS client
-   */ window.addEventListener('message', handleIncomingMessage);
+   */ window.addEventListener('message', handleWindowMessage);
     return ()=>{
         messageTransport.off(hostListener);
         // eslint-disable-next-line @typescript-eslint/ban-ts-comment
         // @ts-expect-error
-        document.removeEventListener('message', handleIncomingMessage);
-        window.removeEventListener('message', handleIncomingMessage);
+        document.removeEventListener('message', handleDocumentMessage);
+        window.removeEventListener('message', handleWindowMessage);
     };
 };
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dynamic-labs-wallet/browser-wallet-client",
-  "version": "1.0.82",
+  "version": "1.0.84",
   "license": "MIT",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.0.82",
+    "@dynamic-labs-wallet/core": "1.0.84",
     "@dynamic-labs/logger": "^4.81.0",
     "@dynamic-labs/message-transport": "^4.81.0"
   },

package/src/services/messageTransportBridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messageTransportBridge.d.ts","sourceRoot":"","sources":["../../src/services/messageTransportBridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AAGzC,eAAO,MAAM,2BAA2B,qBACpB,iCAAiC,UAC3C,iBAAiB,gBACX,MAAM,KACnB,CAAC,MAAM,IAAI,CAmEb,CAAC"}
+{"version":3,"file":"messageTransportBridge.d.ts","sourceRoot":"","sources":["../../src/services/messageTransportBridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AA+BzC,eAAO,MAAM,2BAA2B,qBACpB,iCAAiC,UAC3C,iBAAiB,gBACX,MAAM,KACnB,CAAC,MAAM,IAAI,CA2Eb,CAAC"}