[] fix(security): validate postMessage origins and fix slack middleware path

apps/jira/jira-app/src/components/Auth/OAuth.tsx

@@ -27,8 +27,9 @@ export default class OAuth extends React.Component<Props> {
 
     const oauthWindow = window.open(url, 'Jira Contentful', 'left=150,top=10,width=800,height=900');
 
+    const expectedOrigin = new URL(constants.OAUTH_REDIRECT_URI).origin;
     window.addEventListener('message', (e) => {
-      if (e.source !== oauthWindow) {
+      if (e.source !== oauthWindow || e.origin !== expectedOrigin) {
         return;
       }
 

apps/jira/jira-app/src/standalone.ts

@@ -5,7 +5,7 @@ const standalone = (window: Window) => {
     const error = searchParams.get('error');
 
     if (error) {
-      window.opener.postMessage({ error }, '*');
+      window.opener.postMessage({ error }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
       return;
     }
 
@@ -14,11 +14,11 @@ const standalone = (window: Window) => {
 
     const expireTime = Date.now() + expiresIn * 1000;
 
-    window.opener.postMessage({ token, expireTime }, '*');
+    window.opener.postMessage({ token, expireTime }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
 
     window.history.replaceState({}, 'oauth', '/');
   } else {
-    window.opener.postMessage({ error: 'No query string provided!' }, '*');
+    window.opener.postMessage({ error: 'No query string provided!' }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
   }
 };
 export default standalone;

apps/slack/frontend/src/index.tsx

@@ -15,7 +15,7 @@ if (params.has('result')) {
     accessToken: params.get('accessToken'),
     refreshToken: params.get('refreshToken'),
     errorMessage: params.get('errorMessage'),
-  });
+  }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
   window.close();
 } else {
   const root = document.getElementById('root');

apps/slack/frontend/src/useConnect.ts

@@ -2,7 +2,7 @@ import { useCallback, useContext, useEffect } from 'react';
 import { ConnectedWorkspace, useWorkspaceStore, WorkspaceState } from './workspace.store';
 import { apiClient, slackClient } from './requests';
 import { openPopup } from './helpers';
-import { makeOAuthURL } from './constants';
+import { makeOAuthURL, BACKEND_BASE_URL } from './constants';
 import { getEnvironmentName } from './utils';
 import { SDKContext, useCMA, useSDK } from '@contentful/react-apps-toolkit';
 import { AppExtensionSDK } from '@contentful/app-sdk';
@@ -63,6 +63,10 @@ export const useConnect = () => {
   const [setTemporaryRefreshToken] = useAuthStore((state) => [state.setTemporaryRefreshToken]);
 
   const onMessage = async (message: MessageEvent) => {
+    const expectedOrigin = new URL(BACKEND_BASE_URL).origin;
+    if (message.origin !== expectedOrigin) {
+      return;
+    }
     if (message.data.result === 'error') {
       sdk.notifier.error('Something went wrong while authenticating with Slack. Please try again.');
     }

apps/slack/lambda/lib/app.ts

@@ -52,7 +52,7 @@ export function bootstrap(): serverless.Application {
 
   app.use(createServerlessMiddleware(config.serverless));
   app.use(
-    ['/api/messages', '/api/spaces/*', '/api/events', 'api/tokens'],
+    ['/api/messages', '/api/spaces/*', '/api/events', '/api/tokens'],
     createContentfulRequestVerificationMiddleware(config.signingSecret)
   );
   app.use('/api/slack-events', createSlackEventsMiddleware(config.slack, authTokenRepository));

apps/smartling/frontend/src/Sidebar.tsx

@@ -177,8 +177,8 @@ export default class Sidebar extends React.Component<Props, State> {
     } else if (refresh.failed) {
       const smartlingWindow = window.open('/openauth', '', 'height=600,width=600,top=50,left=50');
 
-      const listener = ({ data, source }: any) => {
-        if (source !== smartlingWindow) {
+      const listener = ({ data, source, origin }: any) => {
+        if (source !== smartlingWindow || origin !== window.location.origin) {
           return;
         }
 

apps/smartling/frontend/src/standalone.ts

@@ -8,7 +8,7 @@ const standalone = (window: Window) => {
 
     window.localStorage.setItem('token', token);
     window.localStorage.setItem('refreshToken', refreshToken);
-    window.opener.postMessage({ token, refreshToken }, '*');
+    window.opener.postMessage({ token, refreshToken }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
   }
 };
 export default standalone;

apps/typeform/frontend/src/processTokenCallback.ts

@@ -7,7 +7,7 @@ const processTokenCallback = (window: Window) => {
     const error = searchParams.get('error');
 
     if (error) {
-      window.opener.postMessage({ error }, '*');
+      window.opener.postMessage({ error }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
       return;
     }
 
@@ -17,11 +17,11 @@ const processTokenCallback = (window: Window) => {
 
     const expireTime = Date.now() + expiresIn * 1000;
 
-    window.opener.postMessage({ token, expireTime }, '*');
+    window.opener.postMessage({ token, expireTime }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
 
     window.history.replaceState({}, 'oauth', '/');
   } else {
-    window.opener.postMessage({ error: 'No query string provided!' }, '*');
+    window.opener.postMessage({ error: 'No query string provided!' }, document.referrer ? new URL(document.referrer).origin : window.location.origin);
   }
 };
 export default processTokenCallback;