openlearn-next 0.2.1 → 0.2.2

package/dist/server.cjs

@@ -18418,9 +18418,69 @@ var BRIDGE_SDK_CODE = `(function() {
     } catch (err) {}
   }
 
+  // \u2500\u2500 Helper: create a safe postMessage wrapper that normalises 'null' \u2192 '*' \u2500\u2500
+  function __makeSafePostMessage(realTarget, label) {
+    return function(message, targetOrigin, transfer) {
+      try {
+        if (message && typeof message === 'object') {
+          if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
+            message.attempt_id = window.__LMS_STUDENT__.attempt_id;
+          }
+          if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
+            message.uuid = window.__LMS_COURSEWARE__.uuid;
+          }
+        }
+      } catch (e) {}
+
+      var origin = targetOrigin;
+      if (origin === 'null' || origin === null || origin === undefined) {
+        console.warn('[LMS Bridge Notice] Normalized invalid targetOrigin "' + origin + '" to "*" for ' + label);
+        origin = '*';
+      }
+      try {
+        return realTarget.postMessage.call(realTarget, message, origin, transfer);
+      } catch (err) {
+        if (err.name === 'SyntaxError' && origin !== '*') {
+          console.warn('[LMS Bridge Notice] Recovered SyntaxError on ' + label + ', fallback to "*"', err);
+          return realTarget.postMessage.call(realTarget, message, '*', transfer);
+        }
+        throw err;
+      }
+    };
+  }
+
+  // \u2500\u2500 Helper: create a Proxy wrapper around a cross-origin WindowProxy \u2500\u2500
+  //    This is necessary because sandboxed iframes (without allow-same-origin)
+  //    cannot set properties on cross-origin WindowProxy objects.
+  //    We use Object.defineProperty to shadow window.parent / window.top
+  //    with a Proxy that intercepts the .postMessage() call.
+  function __proxyWindow(realRef, propName) {
+    try {
+      var safePost = __makeSafePostMessage(realRef, propName + '.postMessage');
+      var proxyObj = new Proxy(realRef, {
+        get: function(target, prop) {
+          if (prop === 'postMessage') return safePost;
+          try {
+            var val = target[prop];
+            if (typeof val === 'function') return val.bind(target);
+            return val;
+          } catch (e) { return undefined; }
+        }
+      });
+      Object.defineProperty(window, propName, {
+        get: function() { return proxyObj; },
+        configurable: true
+      });
+    } catch (e) {
+      // Proxy or defineProperty not supported, fall back to direct override attempt
+      try { realRef.postMessage = __makeSafePostMessage(realRef, propName + '.postMessage (fallback)'); } catch (_) {}
+    }
+  }
+
   // Proxy postMessage calls to enrich them with attempt_id/uuid and normalize targetOrigin
   try {
-    const originalPostMessage = window.postMessage;
+    // 1. Override window.postMessage (self-targeting, always works)
+    var originalPostMessage = window.postMessage;
     window.postMessage = function(message, targetOrigin, transfer) {
       try {
         if (message && typeof message === 'object') {
@@ -18433,49 +18493,67 @@ var BRIDGE_SDK_CODE = `(function() {
         }
       } catch (e) {}
       
-      let origin = targetOrigin;
-      if (origin === 'null') {
+      var origin = targetOrigin;
+      if (origin === 'null' || origin === null || origin === undefined) {
+        console.warn('[LMS Bridge Notice] Normalized invalid targetOrigin "null" to "*" for postMessage call');
         origin = '*';
       }
       try {
         return originalPostMessage.call(this, message, origin, transfer);
       } catch (err) {
         if (err.name === 'SyntaxError' && origin !== '*') {
+          console.warn('[LMS Bridge Notice] Recovered SyntaxError on postMessage, fallback targetOrigin to "*"', err);
           return originalPostMessage.call(this, message, '*', transfer);
         }
         throw err;
       }
     };
 
+    // 2. Shadow window.parent with a Proxy that intercepts .postMessage()
     if (window.parent && window.parent !== window) {
-      const parentPostMessage = window.parent.postMessage;
-      try {
-        window.parent.postMessage = function(message, targetOrigin, transfer) {
-          try {
-            if (message && typeof message === 'object') {
-              if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
-                message.attempt_id = window.__LMS_STUDENT__.attempt_id;
-              }
-              if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
-                message.uuid = window.__LMS_COURSEWARE__.uuid;
+      __proxyWindow(window.parent, 'parent');
+    }
+
+    // 3. Shadow window.top with a Proxy that intercepts .postMessage()
+    try {
+      if (window.top && window.top !== window) {
+        __proxyWindow(window.top, 'top');
+      }
+    } catch (e) {}
+
+    // 4. Intercept message event listeners to sanitize event.source.postMessage replies
+    var origAddEventListener = window.addEventListener;
+    if (typeof origAddEventListener === 'function') {
+      window.addEventListener = function(type, listener, options) {
+        if (type === 'message' && typeof listener === 'function') {
+          var wrappedListener = function(event) {
+            try {
+              if (event && event.source && typeof event.source.postMessage === 'function') {
+                var origSourcePostMessage = event.source.postMessage;
+                event.source.postMessage = function(msg, targetOrigin, transfer) {
+                  var origin = targetOrigin;
+                  if (origin === 'null' || origin === null) {
+                    console.warn('[LMS Bridge Notice] Normalized invalid targetOrigin "null" to "*" on event.source.postMessage');
+                    origin = '*';
+                  }
+                  try {
+                    return origSourcePostMessage.call(event.source, msg, origin, transfer);
+                  } catch (err) {
+                    if (err.name === 'SyntaxError' && origin !== '*') {
+                      console.warn('[LMS Bridge Notice] Recovered SyntaxError on event.source.postMessage, fallback to "*"', err);
+                      return origSourcePostMessage.call(event.source, msg, '*', transfer);
+                    }
+                    throw err;
+                  }
+                };
               }
-            }
-          } catch (e) {}
-          
-          let origin = targetOrigin;
-          if (origin === 'null') {
-            origin = '*';
-          }
-          try {
-            return parentPostMessage.call(window.parent, message, origin, transfer);
-          } catch (err) {
-            if (err.name === 'SyntaxError' && origin !== '*') {
-              return parentPostMessage.call(window.parent, message, '*', transfer);
-            }
-            throw err;
-          }
-        };
-      } catch (e) {}
+            } catch (e) {}
+            return listener.apply(this, arguments);
+          };
+          return origAddEventListener.call(this, type, wrappedListener, options);
+        }
+        return origAddEventListener.apply(this, arguments);
+      };
     }
   } catch (e) {}
 
@@ -23877,7 +23955,7 @@ async function startServer() {
         imgSrc: ["'self'", "data:", "blob:", "https:"],
         connectSrc: ["'self'", "ws:", "wss:", "https:"],
         fontSrc: ["'self'", "data:", "https:", "https://fonts.gstatic.com"],
-        frameSrc: ["'self'"],
+        frameSrc: ["'self'", "blob:", "data:", "http://localhost", "http://127.0.0.1", "http:", "https:"],
         objectSrc: ["'none'"]
       }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [