@elliemae/microfe-common 2.25.0 → 2.25.1

package/dist/cjs/remoting.js

@@ -66,17 +66,21 @@ class Remoting {
    * The set of windows that are allowed to send messages to this window
    */
   #allowedSenders = /* @__PURE__ */ new Map();
+  #disableOriginCheck;
   /**
    * Create a new instance of the Remoting class
    * @param logger pui-diagnostic logger
    * @param correlationId unique id for the current session
+   * @param options optional configuration
    */
-  constructor(logger, correlationId) {
+  constructor(logger, correlationId, options) {
     if (!logger) throw new Error("logger is required");
     if (!correlationId) throw new Error("correlationId is required");
     this.#correlationId = correlationId;
     this.#logger = logger;
+    this.#disableOriginCheck = options?.unsafeAllowAnyGuestOrigin ?? false;
   }
+  #getTargetOrigin = (targetOrigin) => this.#disableOriginCheck ? "*" : targetOrigin;
   // Evaluates the timeouts on any waiting invocations and schedules the next check
   #evaluateTimeouts = () => {
     this.#timeoutMonitorHandle = null;
@@ -259,7 +263,7 @@ class Remoting {
         reject,
         cancelTime: responseTimeoutMs ? Date.now() + responseTimeoutMs : null
       });
-      targetWin.postMessage(msg, targetOrigin);
+      targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
       const { requestId } = msg;
       this.#logger.debug(
         `Posted invocation message of type ${messageType} requestId: ${requestId || ""}`
@@ -306,7 +310,7 @@ class Remoting {
       messageBody,
       onewayMsg: true
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(`Posted one-way message of type "${messageType}"`);
   };
   /**
@@ -328,7 +332,7 @@ class Remoting {
       messageBody: response,
       requestId
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Response sent to caller for invocation requestId: ${requestId}`
     );
@@ -345,7 +349,7 @@ class Remoting {
       messageBody,
       requestId
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Exception sent to caller for invocation. requestId: ${requestId}`
     );

package/dist/esm/remoting.js

@@ -42,17 +42,21 @@ class Remoting {
    * The set of windows that are allowed to send messages to this window
    */
   #allowedSenders = /* @__PURE__ */ new Map();
+  #disableOriginCheck;
   /**
    * Create a new instance of the Remoting class
    * @param logger pui-diagnostic logger
    * @param correlationId unique id for the current session
+   * @param options optional configuration
    */
-  constructor(logger, correlationId) {
+  constructor(logger, correlationId, options) {
     if (!logger) throw new Error("logger is required");
     if (!correlationId) throw new Error("correlationId is required");
     this.#correlationId = correlationId;
     this.#logger = logger;
+    this.#disableOriginCheck = options?.unsafeAllowAnyGuestOrigin ?? false;
   }
+  #getTargetOrigin = (targetOrigin) => this.#disableOriginCheck ? "*" : targetOrigin;
   // Evaluates the timeouts on any waiting invocations and schedules the next check
   #evaluateTimeouts = () => {
     this.#timeoutMonitorHandle = null;
@@ -235,7 +239,7 @@ class Remoting {
         reject,
         cancelTime: responseTimeoutMs ? Date.now() + responseTimeoutMs : null
       });
-      targetWin.postMessage(msg, targetOrigin);
+      targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
       const { requestId } = msg;
       this.#logger.debug(
         `Posted invocation message of type ${messageType} requestId: ${requestId || ""}`
@@ -282,7 +286,7 @@ class Remoting {
       messageBody,
       onewayMsg: true
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(`Posted one-way message of type "${messageType}"`);
   };
   /**
@@ -304,7 +308,7 @@ class Remoting {
       messageBody: response,
       requestId
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Response sent to caller for invocation requestId: ${requestId}`
     );
@@ -321,7 +325,7 @@ class Remoting {
       messageBody,
       requestId
     });
-    targetWin.postMessage(msg, targetOrigin);
+    targetWin.postMessage(msg, this.#getTargetOrigin(targetOrigin));
     this.#logger.debug(
       `Exception sent to caller for invocation. requestId: ${requestId}`
     );

package/dist/types/lib/index.d.ts

@@ -1,5 +1,5 @@
 export { Remoting, sendMessage } from './remoting.js';
-export type { ListenerCallback, ListenerCallbackParams, ListenParam, InvokeParam, RaiseExceptionParam, RespondParam, SendParam, AddSenderParam, } from './remoting.js';
+export type { ListenerCallback, ListenerCallbackParams, ListenParam, InvokeParam, RaiseExceptionParam, RemotingOptions, RespondParam, SendParam, AddSenderParam, } from './remoting.js';
 export type { RemotingEventMessage } from './remotingEventMessage.js';
 export { getEventId, ProxyEvent } from './event.js';
 export type { IScriptingObjectProxyEvent, EventParam, DispatchEventParam, EventOptions, SubscribeParam, UnsubscribeParam, IEventManager, FilterCriteria, FilterOperator, } from './event.js';

package/dist/types/lib/remoting.d.ts

@@ -171,14 +171,24 @@ export type AddSenderParam = {
 /**
  * Provides core messaging capabilities for cross-frame interactions in a sandboxed environment.
  */
+export type RemotingOptions = {
+    /**
+     * **UNSAFE**: When true, uses '*' as the targetOrigin for all outbound postMessage calls,
+     * bypassing the browser's origin check on the receiving window. This means any window
+     * can receive messages intended for the guest, potentially exposing sensitive data.
+     * Only enable this if you fully understand the security implications.
+     */
+    unsafeAllowAnyGuestOrigin?: boolean;
+};
 export declare class Remoting {
     #private;
     /**
      * Create a new instance of the Remoting class
      * @param logger pui-diagnostic logger
      * @param correlationId unique id for the current session
+     * @param options optional configuration
      */
-    constructor(logger: Logger, correlationId: string);
+    constructor(logger: Logger, correlationId: string, options?: RemotingOptions);
     /**
      * Adds window and its origin list of allowed senders
      * @param {AddSenderParam} param - The sender to add