Skip to content

fix: Harden extension host iframe message origin validation#280

Merged
skazantsev merged 1 commit into
mainfrom
fix/main-extension-host-iframe-origin
Jul 9, 2026
Merged

fix: Harden extension host iframe message origin validation#280
skazantsev merged 1 commit into
mainfrom
fix/main-extension-host-iframe-origin

Conversation

@skazantsev

@skazantsev skazantsev commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Harden the web worker extension host iframe's message origin validation
  • Ensure parentOrigin defaults to window.origin for self-hosted deployments

Test plan

  • Verify Code Editor loads normally (extensions activate, file tree, terminal)
  • Verify extension host iframe rejects postMessage from cross-origin pages

@skazantsev skazantsev requested a review from a team as a code owner July 9, 2026 13:53
@skazantsev skazantsev added this pull request to the merge queue Jul 9, 2026
Merged via the queue into main with commit c9e2468 Jul 9, 2026
3 checks passed
@skazantsev skazantsev deleted the fix/main-extension-host-iframe-origin branch July 9, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sachinh-amazon sachinh-amazon sachinh-amazon approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@skazantsev @sachinh-amazon