@elliemae/microfe-common 2.22.0 → 2.22.1

package/dist/cjs/remoting.js

@@ -61,17 +61,21 @@ class Remoting {
    * The set of windows that are allowed to send messages to this window
    */
   #allowedSenders = /* @__PURE__ */ new Map();
+  #disableOriginCheck;
   /**
    * Create a new instance of the Remoting class
    * @param logger pui-diagnostic logger
    * @param correlationId unique id for the current session
+   * @param options optional configuration
    */
-  constructor(logger, correlationId) {
+  constructor(logger, correlationId, options) {
     if (!logger) throw new Error("logger is required");
     if (!correlationId) throw new Error("correlationId is required");
     this.#correlationId = correlationId;
     this.#logger = logger;
+    this.#disableOriginCheck = options?.unsafeAllowAnyGuestOrigin ?? false;
   }
+  #getTargetOrigin = (targetOrigin) => this.#disableOriginCheck ? "*" : targetOrigin;
   // Evaluates the timeouts on any waiting invocations
   #evaluateTimeouts = () => {
     const ts = Date.now();
@@ -249,7 +253,7 @@ class Remoting {
         reject,
         cancelTime: responseTimeoutMs ? Date.now() + Number.parseInt(responseTimeoutMs, 10) : null
       });
-      targetWin.postMessage(msg, targetOrigin);
+      targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
       const { requestId } = msg;
       this.#logger.debug(
         `Posted invocation message of type ${messageType} requestId: ${requestId || ""}`
@@ -283,7 +287,7 @@ class Remoting {
       messageBody,
       onewayMsg: true
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(`Posted one-way message of type "${messageType}"`);
   };
   /**
@@ -305,7 +309,7 @@ class Remoting {
       messageBody: response
     });
     msg.requestId = requestId;
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Response sent to caller for invocation requestId: ${requestId}`
     );
@@ -321,7 +325,7 @@ class Remoting {
       messageBody: ex
     });
     msg.requestId = requestId;
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Exception sent to caller for invocation. requestId: ${requestId}`
     );

package/dist/esm/remoting.js

@@ -37,17 +37,21 @@ class Remoting {
    * The set of windows that are allowed to send messages to this window
    */
   #allowedSenders = /* @__PURE__ */ new Map();
+  #disableOriginCheck;
   /**
    * Create a new instance of the Remoting class
    * @param logger pui-diagnostic logger
    * @param correlationId unique id for the current session
+   * @param options optional configuration
    */
-  constructor(logger, correlationId) {
+  constructor(logger, correlationId, options) {
     if (!logger) throw new Error("logger is required");
     if (!correlationId) throw new Error("correlationId is required");
     this.#correlationId = correlationId;
     this.#logger = logger;
+    this.#disableOriginCheck = options?.unsafeAllowAnyGuestOrigin ?? false;
   }
+  #getTargetOrigin = (targetOrigin) => this.#disableOriginCheck ? "*" : targetOrigin;
   // Evaluates the timeouts on any waiting invocations
   #evaluateTimeouts = () => {
     const ts = Date.now();
@@ -225,7 +229,7 @@ class Remoting {
         reject,
         cancelTime: responseTimeoutMs ? Date.now() + Number.parseInt(responseTimeoutMs, 10) : null
       });
-      targetWin.postMessage(msg, targetOrigin);
+      targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
       const { requestId } = msg;
       this.#logger.debug(
         `Posted invocation message of type ${messageType} requestId: ${requestId || ""}`
@@ -259,7 +263,7 @@ class Remoting {
       messageBody,
       onewayMsg: true
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(`Posted one-way message of type "${messageType}"`);
   };
   /**
@@ -281,7 +285,7 @@ class Remoting {
       messageBody: response
     });
     msg.requestId = requestId;
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Response sent to caller for invocation requestId: ${requestId}`
     );
@@ -297,7 +301,7 @@ class Remoting {
       messageBody: ex
     });
     msg.requestId = requestId;
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Exception sent to caller for invocation. requestId: ${requestId}`
     );

package/dist/types/lib/index.d.ts

@@ -1,5 +1,5 @@
 export { Remoting, sendMessage } from './remoting.js';
-export type { ListenerCallback, ListenerCallbackParams, ListenParam, InvokeParam, RaiseExceptionParam, RespondParam, SendParam, AddSenderParam, } from './remoting.js';
+export type { ListenerCallback, ListenerCallbackParams, ListenParam, InvokeParam, RaiseExceptionParam, RemotingOptions, RespondParam, SendParam, AddSenderParam, } from './remoting.js';
 export type { RemotingEventMessage } from './remotingEventMessage.js';
 export { getEventId, ProxyEvent } from './event.js';
 export type { IScriptingObjectProxyEvent, EventParam, DispatchEventParam, EventOptions, SubscribeParam, UnsubscribeParam, IEventManager, FilterCriteria, FilterOperator, } from './event.js';

package/dist/types/lib/remoting.d.ts

@@ -171,14 +171,24 @@ export type AddSenderParam = {
 /**
  * Provides core messaging capabilities for cross-frame interactions in a sandboxed environment.
  */
+export type RemotingOptions = {
+    /**
+     * **UNSAFE**: When true, uses '*' as the targetOrigin for all outbound postMessage calls,
+     * bypassing the browser's origin check on the receiving window. This means any window
+     * can receive messages intended for the guest, potentially exposing sensitive data.
+     * Only enable this if you fully understand the security implications.
+     */
+    unsafeAllowAnyGuestOrigin?: boolean;
+};
 export declare class Remoting {
     #private;
     /**
      * Create a new instance of the Remoting class
      * @param logger pui-diagnostic logger
      * @param correlationId unique id for the current session
+     * @param options optional configuration
      */
-    constructor(logger: Logger, correlationId: string);
+    constructor(logger: Logger, correlationId: string, options?: RemotingOptions);
     /**
      * Adds window and its origin list of allowed senders
      * @param {AddSenderParam} param - The sender to add