@dynamic-labs/iframe-setup 4.91.5 → 4.92.0

package/CHANGELOG.md

@@ -1,4 +1,27 @@
 
+## [4.92.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.6...v4.92.0) (2026-07-08)
+
+
+### Features
+
+* **captcha:** add Cloudflare Turnstile provider support alongside hCaptcha (v4) ([#11798](https://github.com/dynamic-labs/dynamic-auth/issues/11798)) ([114c770](https://github.com/dynamic-labs/dynamic-auth/commit/114c7702e900d8dedeebe7be867de35d11a93f31))
+
+
+### Bug Fixes
+
+* **ethereum-aa:** resolve kernel client config per wallet (v4) ([#11870](https://github.com/dynamic-labs/dynamic-auth/issues/11870)) ([1b66d79](https://github.com/dynamic-labs/dynamic-auth/commit/1b66d79b4a32b4b6de433b7536bc46e6719224c6))
+* **iframe-setup:** block dangerous URL schemes and verify sender in OPEN_URL ([#11819](https://github.com/dynamic-labs/dynamic-auth/issues/11819)) ([329b27e](https://github.com/dynamic-labs/dynamic-auth/commit/329b27e9fac825916ab227ec8cf93dc343898923))
+* improve social OAuth error messages ([#11837](https://github.com/dynamic-labs/dynamic-auth/issues/11837)) ([8e57c06](https://github.com/dynamic-labs/dynamic-auth/commit/8e57c067c5a89111a32a12fb82e190cf6c46ad67))
+* **react-native-extension:** reject path traversal in downloadFile fileName ([#11816](https://github.com/dynamic-labs/dynamic-auth/issues/11816)) ([9367a56](https://github.com/dynamic-labs/dynamic-auth/commit/9367a56b6daa853d7f7e7f5534261bc68825b239))
+* **sdk-react-core:** display exactly the bytes signed in personal_sign preview ([#11818](https://github.com/dynamic-labs/dynamic-auth/issues/11818)) ([30b9382](https://github.com/dynamic-labs/dynamic-auth/commit/30b93829122f00060cb484aef09a03294c03f651))
+
+### [4.91.6](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.5...v4.91.6) (2026-07-03)
+
+
+### Bug Fixes
+
+* **react-native:** ensure webview loads on cold start ([#11787](https://github.com/dynamic-labs/dynamic-auth/issues/11787)) ([8f3dc8e](https://github.com/dynamic-labs/dynamic-auth/commit/8f3dc8e2a7de06f012ea6e922d4e76aee1c84c1a))
+
 ### [4.91.5](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.4...v4.91.5) (2026-07-02)
 
 

package/README.md

@@ -146,12 +146,20 @@ export const setupIframe = (
 ): VoidFunction => {
   if (typeof window === 'undefined') return () => {};
 
-  const messageHandler = createMessageHandler<IFRAME_EVENTS>(window, origin);
+  const messageHandler = createMessageHandler<IFRAME_EVENTS>(
+    window,
+    origin,
+    iframe,
+  );
   const messageSender = createMessageSender<IFRAME_EVENTS>(iframe);
 
   // Add event listener to handle deeplink
   const setupOpenUrlHandler = () =>
     messageHandler('OPEN_URL', ({ url, target = 'self', features }) => {
+      // This navigates the host top window, so never honor a URL whose scheme
+      // can execute script in the host origin (iframe->host XSS).
+      if (hasDangerousScheme(url)) return;
+
       if (target === 'blank') {
         window.open(url, '_blank', features);
       } else {
@@ -220,6 +228,45 @@ export const setupIframe = (
 
 // Utils
 
+/**
+ * URL schemes that can execute script in the host origin. Navigating the host
+ * top window to any of these turns an OPEN_URL message into arbitrary code
+ * execution in the integrator's origin, so they are blocked.
+ *
+ * A deny-list (rather than an http/https allow-list) is used deliberately:
+ * wallet flows legitimately open custom-scheme deep links, and allow-listing
+ * http(s) would break them.
+ */
+const DANGEROUS_SCHEMES = [
+  'javascript:',
+  'data:',
+  'blob:',
+  'vbscript:',
+  'file:',
+];
+
+/**
+ * Leading characters the browser ignores when resolving a URL scheme: spaces,
+ * tabs, newlines and other C0 control chars (U+0000–U+0020). Stripping them
+ * defeats obfuscation such as "\tjavascript:alert(1)".
+ */
+// eslint-disable-next-line no-control-regex
+const LEADING_IGNORED_CHARS = /^[\u0000-\u0020]+/;
+
+/**
+ * Returns true when the URL begins with a script-executing scheme.
+ *
+ * Non-string input is treated as dangerous, leading ignored chars are stripped
+ * first, and the comparison is case-insensitive ("JavaScript:" is blocked).
+ */
+const hasDangerousScheme = (url: unknown): boolean => {
+  if (typeof url !== 'string') return true;
+
+  const normalized = url.replace(LEADING_IGNORED_CHARS, '').toLowerCase();
+
+  return DANGEROUS_SCHEMES.some((scheme) => normalized.startsWith(scheme));
+};
+
 /**
  * Custom event dispatched when the parent URL changes via the History API.
  * Used instead of re-patching history per setupIframe call so that multiple
@@ -262,7 +309,11 @@ const patchHistoryOnce = (): void => {
  * Create a message handler for the iframe
  */
 const createMessageHandler =
-  <T extends Record<string, MESSAGE_HANDLER>>(window: Window, origin: string) =>
+  <T extends Record<string, MESSAGE_HANDLER>>(
+    window: Window,
+    origin: string,
+    iframe: HTMLIFrameElement,
+  ) =>
   <EVENT_NAME extends Extract<keyof T, string>>(
     eventName: EVENT_NAME,
     handler: T[EVENT_NAME],
@@ -270,6 +321,10 @@ const createMessageHandler =
     const messageHandler = (event: MessageEvent) => {
       if (event.origin !== origin) return;
 
+      // Only trust messages coming from this iframe's own window. Checking the
+      // origin alone lets any frame/tab at the SDK-iframe origin forge events.
+      if (event.source !== iframe.contentWindow) return;
+
       const { eventName: incomingEventName, args } = event.data;
 
       if (eventName === incomingEventName) {

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.91.5";
+var version = "4.92.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.91.5";
+var version = "4.92.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/iframe-setup",
-  "version": "4.91.5",
+  "version": "4.92.0",
   "description": "Collection of utilities to use the Dynamic SDK in an iframe",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -18,7 +18,7 @@
   },
   "homepage": "https://www.dynamic.xyz/",
   "dependencies": {
-    "@dynamic-labs/assert-package-version": "4.91.5"
+    "@dynamic-labs/assert-package-version": "4.92.0"
   },
   "peerDependencies": {}
 }

package/src/lib/setupIframe/setupIframe.cjs

@@ -22,10 +22,14 @@ Object.defineProperty(exports, '__esModule', { value: true });
 const setupIframe = (iframe, origin) => {
     if (typeof window === 'undefined')
         return () => { };
-    const messageHandler = createMessageHandler(window, origin);
+    const messageHandler = createMessageHandler(window, origin, iframe);
     const messageSender = createMessageSender(iframe);
     // Add event listener to handle deeplink
     const setupOpenUrlHandler = () => messageHandler('OPEN_URL', ({ url, target = 'self', features }) => {
+        // This navigates the host top window, so never honor a URL whose scheme
+        // can execute script in the host origin (iframe->host XSS).
+        if (hasDangerousScheme(url))
+            return;
         if (target === 'blank') {
             window.open(url, '_blank', features);
         }
@@ -82,6 +86,41 @@ const setupIframe = (iframe, origin) => {
     return () => cleanupHandlers.forEach((offHandler) => offHandler());
 };
 // Utils
+/**
+ * URL schemes that can execute script in the host origin. Navigating the host
+ * top window to any of these turns an OPEN_URL message into arbitrary code
+ * execution in the integrator's origin, so they are blocked.
+ *
+ * A deny-list (rather than an http/https allow-list) is used deliberately:
+ * wallet flows legitimately open custom-scheme deep links, and allow-listing
+ * http(s) would break them.
+ */
+const DANGEROUS_SCHEMES = [
+    'javascript:',
+    'data:',
+    'blob:',
+    'vbscript:',
+    'file:',
+];
+/**
+ * Leading characters the browser ignores when resolving a URL scheme: spaces,
+ * tabs, newlines and other C0 control chars (U+0000–U+0020). Stripping them
+ * defeats obfuscation such as "\tjavascript:alert(1)".
+ */
+// eslint-disable-next-line no-control-regex
+const LEADING_IGNORED_CHARS = /^[\u0000-\u0020]+/;
+/**
+ * Returns true when the URL begins with a script-executing scheme.
+ *
+ * Non-string input is treated as dangerous, leading ignored chars are stripped
+ * first, and the comparison is case-insensitive ("JavaScript:" is blocked).
+ */
+const hasDangerousScheme = (url) => {
+    if (typeof url !== 'string')
+        return true;
+    const normalized = url.replace(LEADING_IGNORED_CHARS, '').toLowerCase();
+    return DANGEROUS_SCHEMES.some((scheme) => normalized.startsWith(scheme));
+};
 /**
  * Custom event dispatched when the parent URL changes via the History API.
  * Used instead of re-patching history per setupIframe call so that multiple
@@ -117,10 +156,14 @@ const patchHistoryOnce = () => {
 /**
  * Create a message handler for the iframe
  */
-const createMessageHandler = (window, origin) => (eventName, handler) => {
+const createMessageHandler = (window, origin, iframe) => (eventName, handler) => {
     const messageHandler = (event) => {
         if (event.origin !== origin)
             return;
+        // Only trust messages coming from this iframe's own window. Checking the
+        // origin alone lets any frame/tab at the SDK-iframe origin forge events.
+        if (event.source !== iframe.contentWindow)
+            return;
         const { eventName: incomingEventName, args } = event.data;
         if (eventName === incomingEventName) {
             handler(...args);

package/src/lib/setupIframe/setupIframe.js

@@ -18,10 +18,14 @@
 const setupIframe = (iframe, origin) => {
     if (typeof window === 'undefined')
         return () => { };
-    const messageHandler = createMessageHandler(window, origin);
+    const messageHandler = createMessageHandler(window, origin, iframe);
     const messageSender = createMessageSender(iframe);
     // Add event listener to handle deeplink
     const setupOpenUrlHandler = () => messageHandler('OPEN_URL', ({ url, target = 'self', features }) => {
+        // This navigates the host top window, so never honor a URL whose scheme
+        // can execute script in the host origin (iframe->host XSS).
+        if (hasDangerousScheme(url))
+            return;
         if (target === 'blank') {
             window.open(url, '_blank', features);
         }
@@ -78,6 +82,41 @@ const setupIframe = (iframe, origin) => {
     return () => cleanupHandlers.forEach((offHandler) => offHandler());
 };
 // Utils
+/**
+ * URL schemes that can execute script in the host origin. Navigating the host
+ * top window to any of these turns an OPEN_URL message into arbitrary code
+ * execution in the integrator's origin, so they are blocked.
+ *
+ * A deny-list (rather than an http/https allow-list) is used deliberately:
+ * wallet flows legitimately open custom-scheme deep links, and allow-listing
+ * http(s) would break them.
+ */
+const DANGEROUS_SCHEMES = [
+    'javascript:',
+    'data:',
+    'blob:',
+    'vbscript:',
+    'file:',
+];
+/**
+ * Leading characters the browser ignores when resolving a URL scheme: spaces,
+ * tabs, newlines and other C0 control chars (U+0000–U+0020). Stripping them
+ * defeats obfuscation such as "\tjavascript:alert(1)".
+ */
+// eslint-disable-next-line no-control-regex
+const LEADING_IGNORED_CHARS = /^[\u0000-\u0020]+/;
+/**
+ * Returns true when the URL begins with a script-executing scheme.
+ *
+ * Non-string input is treated as dangerous, leading ignored chars are stripped
+ * first, and the comparison is case-insensitive ("JavaScript:" is blocked).
+ */
+const hasDangerousScheme = (url) => {
+    if (typeof url !== 'string')
+        return true;
+    const normalized = url.replace(LEADING_IGNORED_CHARS, '').toLowerCase();
+    return DANGEROUS_SCHEMES.some((scheme) => normalized.startsWith(scheme));
+};
 /**
  * Custom event dispatched when the parent URL changes via the History API.
  * Used instead of re-patching history per setupIframe call so that multiple
@@ -113,10 +152,14 @@ const patchHistoryOnce = () => {
 /**
  * Create a message handler for the iframe
  */
-const createMessageHandler = (window, origin) => (eventName, handler) => {
+const createMessageHandler = (window, origin, iframe) => (eventName, handler) => {
     const messageHandler = (event) => {
         if (event.origin !== origin)
             return;
+        // Only trust messages coming from this iframe's own window. Checking the
+        // origin alone lets any frame/tab at the SDK-iframe origin forge events.
+        if (event.source !== iframe.contentWindow)
+            return;
         const { eventName: incomingEventName, args } = event.data;
         if (eventName === incomingEventName) {
             handler(...args);