proxyinterceptor.js

(function() {
    console.log("Initializing active postMessage proxy interceptor.");
    let sensitiveDataDisclosed = false;

    const originalPostMessage = window.postMessage;
    window.postMessage = function(message, targetOrigin, transfer) {
        console.log(" OUTGOING postMessage detected:");
        console.log("  Target Origin:", targetOrigin);
        console.log("  Payload:", message);
        if (typeof message === 'string' && message.includes('access_token')) {
             console.error("TRUE POSITIVE: Sensitive token being broadcasted to a cross-origin target.");
             sensitiveDataDisclosed = true;
        }
        return originalPostMessage.call(this, message, targetOrigin, transfer);
    };

    window.addEventListener('message', function(event) {
        console.log(" INCOMING postMessage intercepted:");
        console.log("  Source Origin:", event.origin);
        console.log("  Source Frame:", event.source ? window.location.origin : "Unknown/CSP Blocked");
        console.log("  Payload:", event.data);

        if (event.origin !== window.location.origin) {
            console.warn("Cross-origin message received from: " + event.origin);
            if (event.data && event.data.type === "render" && typeof event.data.html === "string") {
                console.error("TRUE POSITIVE: External origin attempting DOM injection via postMessage.");
                sensitiveDataDisclosed = true;
            }
        }
    }, true);
})();