@salesforce-ui-embedding/internal-lightning-ui-embedding 2.2.7-rc.3 → 2.2.7

package/dist/modules/lightning/uiEmbedding/uiEmbedding.js

@@ -25,7 +25,7 @@ import {
     UI_STATE_UNSUBSCRIBE_METHOD,
 } from "./utils/sf-embedding-contract";
 import { composeUiState, MIRRORED_ATTRIBUTES } from "./utils/ui-state";
-import { appendHostMetaData, parseOrigin } from "./utils/url";
+import { appendHostMetaData, isLightningDomain, parseOrigin } from "./utils/url";
 
 /** Stable reference for null/undefined `props` so the setter's `===` guard can short-circuit. */
 const EMPTY_PROPS = Object.freeze({});
@@ -312,7 +312,8 @@ export default class Embedding extends LightningElement {
                 message: "iframe src MUST be a parseable URL.",
             };
         }
-        if (this._iframeSrcOrigin === window.location.origin) {
+        const hostOrigin = window.location.origin;
+        if (this._iframeSrcOrigin === hostOrigin && !isLightningDomain(hostOrigin)) {
             return {
                 code: ERROR_CODES.SAME_ORIGIN_SRC,
                 message: "iframe src origin MUST differ from the host document origin.",

package/dist/modules/lightning/uiEmbedding/utils/constants.js

@@ -5,6 +5,23 @@
 
 export const DEFAULT_SANDBOX_TOKENS = ["allow-scripts", "allow-same-origin"];
 
+// Source of truth: Core's AuraDomainSuffix Lightning family (domainsuffix.xml); matched with anchored endsWith.
+// Parity is manual and fails closed — a new Core Lightning suffix isn't honored here until this list is
+// hand-updated. A follow-up work item (W-24242222) tracks automated drift detection between the two lists.
+export const LIGHTNING_DOMAIN_SUFFIXES = [
+    ".lightning.force.com",
+    ".lightning.crmforce.mil",
+    // .lightning.sfcrmapps.cn (China/CAG) deferred pending Secure Domains/CAG sign-off.
+    ".my-lightning.com",
+    // Internal R&D/perf-pod host, NOT customer-facing.
+    ".lightning.pc-rnd.force.com",
+];
+
+// SFW/local-dev hosts: hyphenated family label + workspace hash + location before .crm.dev; endsWith can't
+// anchor a mid-hostname marker, so this regex anchors both the .lightning.<family>. label and the trailing .crm.dev.
+export const SFW_DEV_LIGHTNING_DOMAIN_PATTERN =
+    /\.lightning\.(?:force-com|crmforce-mil)\.[a-z0-9-]+(?:\.[a-z0-9-]+)*\.crm\.dev$/i;
+
 // Default advisory heartbeat deadline; Infinity opts out.
 export const DEFAULT_HEARTBEAT_TIMEOUT_MS = 30_000;
 

package/dist/modules/lightning/uiEmbedding/utils/host-info.js

@@ -3,11 +3,11 @@
  * For full license text, see the LICENSE.txt file in this package.
  */
 
-// `"2.2.7-rc.3"` is a repo-wide ambient declared in /types/globals.d.ts;
+// `"2.2.7"` is a repo-wide ambient declared in /types/globals.d.ts;
 // build.mjs substitutes the literal at build time, jest globals supply a test value.
 
 /** Identity emitted on `ui/notifications/host-initialized`. */
 export const HOST_INFO = {
     name: "lightning-ui-embedding",
-    version: "2.2.7-rc.3",
+    version: "2.2.7",
 };

package/dist/modules/lightning/uiEmbedding/utils/url.js

@@ -3,16 +3,31 @@
  * For full license text, see the LICENSE.txt file in this package.
  */
 
+import { LIGHTNING_DOMAIN_SUFFIXES, SFW_DEV_LIGHTNING_DOMAIN_PATTERN } from "./constants";
 import { HOST_META_DATA_PARAM } from "./sf-embedding-contract";
 
-export function parseOrigin(src) {
+function safeUrl(input) {
     try {
-        return new URL(src).origin;
+        return new URL(input);
     } catch {
         return null;
     }
 }
 
+export function parseOrigin(src) {
+    return safeUrl(src)?.origin ?? null;
+}
+
+// True when the origin is a Lightning domain (prod suffixes or SFW/local-dev pattern); set-synonymous with
+// SfdcUrl.isLightningDomain || isInternalUrl, endsWith-anchored so evil.lightning.force.com.attacker.com fails.
+export function isLightningDomain(origin) {
+    const hostname = safeUrl(origin ?? "")?.hostname ?? "";
+    return (
+        LIGHTNING_DOMAIN_SUFFIXES.some((suffix) => hostname.endsWith(suffix)) ||
+        SFW_DEV_LIGHTNING_DOMAIN_PATTERN.test(hostname)
+    );
+}
+
 export function appendHostMetaData(src, instanceId, hostAppOrigin) {
     const url = new URL(src);
     const meta = { instanceId, hostAppOrigin };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce-ui-embedding/internal-lightning-ui-embedding",
-    "version": "2.2.7-rc.3",
+    "version": "2.2.7",
     "private": false,
     "description": "Lightning Base Component (LWC) host for sf-embedding-protocol iframes",
     "license": "SEE LICENSE IN LICENSE.txt",
@@ -22,8 +22,8 @@
     },
     "devDependencies": {
         "@salesforce/jsonrpc": "^10.12.3",
-        "@salesforce/sf-embedding-contract": "2.2.7-rc.3",
-        "utils": "2.2.7-rc.3"
+        "@salesforce/sf-embedding-contract": "2.2.7",
+        "utils": "2.2.7"
     },
     "sideEffects": false,
     "publishConfig": {