Changeset 35761

Timestamp:

12/03/2015 08:16:28 PM (9 years ago)

Author:

wonderboymusic

Message:

WP oEmbed: validate the secret send via postMessage in wp.receiveEmbedMessage. Also, compare window instances.

In the data sent to us from the embedded iframe by postMessage(), the secret value is being used directly in a document.querySelectorAll() call without first being validated or escaped.

In theory, this could lead to some broken embeds.

Props mdawaffe.
Fixes #34831.

File:

• trunk/src/wp-includes/js/wp-embed.js (modified) (2 diffs)

trunk/src/wp-includes/js/wp-embed.js

@@ -23 +23 @@
         }
 
+        if ( /[^a-zA-Z0-9]/.test( data.secret ) ) {
+            return;
+        }
+
         var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
             blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
@@ -33 +37 @@
         for ( i = 0; i < iframes.length; i++ ) {
             source = iframes[ i ];
+
+            if ( e.source !== source.contentWindow ) {
+                continue;
+            }
 
             source.style.display = '';