Isolate 4.3.0 test from attack iframe one

GoogleChromeLabs · Mar 7, 2023 · 0d49cdc · 0d49cdc
1 parent 191bb15
commit 0d49cdc
Show file tree

Hide file tree

Showing 3 changed files with 51 additions and 29 deletions.
diff --git a/src/comlink.ts b/src/comlink.ts
@@ -410,7 +410,11 @@ function isMessagePort(endpoint: Endpoint): endpoint is MessagePort {
 }
 
 function isEndpoint(endpoint: object): endpoint is Endpoint {
-  return "postMessage" in endpoint && "addEventListener" in endpoint && "removeEventListener" in endpoint;
+  return (
+    "postMessage" in endpoint &&
+    "addEventListener" in endpoint &&
+    "removeEventListener" in endpoint
+  );
 }
 
 function markV430Ports(...args: any[]) {

diff --git a/tests/fixtures/v430comlink.html b/tests/fixtures/v430comlink.html
@@ -2,34 +2,45 @@
   // comlink main
   import * as Comlink from "/base/dist/esm/comlink.mjs";
 
-  const parentEndpoint = Comlink.windowEndpoint(self.parent);
-
-  class Test {
-    async acceptProxy(aProxy) {
-      return (await aProxy()) + 1;
+  window.addEventListener("message", function l(ev) {
+    if (
+      ev.data &&
+      typeof ev.data === "object" &&
+      ev.data.constructor.name === "MessagePort"
+    ) {
+      window.removeEventListener("message", l);
+      register(ev.data);
     }
+  });
 
-    callme(port) {
-      Comlink.wrap(port).maybe();
-    }
+  function register(parentEndpoint) {
+    class Test {
+      async acceptProxy(aProxy) {
+        return (await aProxy()) + 1;
+      }
 
-    iwannabeaport = undefined;
+      callme(port) {
+        Comlink.wrap(port).maybe();
+      }
 
-    wrapWannaBeAndCall() {
-      Comlink.wrap(this.iwannabeaport).rise();
-    }
+      iwannabeaport = undefined;
 
-    pong(ping) {
-      return ping;
+      wrapWannaBeAndCall() {
+        Comlink.wrap(this.iwannabeaport).rise();
+      }
+
+      pong(ping) {
+        return ping;
+      }
     }
-  }
 
-  Comlink.expose(new Test(), parentEndpoint);
-  Comlink.transferHandlers.set("pingpong", {
-    canHandle: (obj) => obj === "ping",
-    serialize: (obj) => {
-      return ["pong", []];
-    },
-    deserialize: (obj) => "ping",
-  });
+    Comlink.expose(new Test(), parentEndpoint);
+    Comlink.transferHandlers.set("pingpong", {
+      canHandle: (obj) => obj === "ping",
+      serialize: (obj) => {
+        return ["pong", []];
+      },
+      deserialize: (obj) => "ping",
+    });
+  }
 </script>
diff --git a/tests/v430comlink.test.js b/tests/v430comlink.test.js
@@ -18,6 +18,7 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
   let oldTruncateThreshold;
   let notcalled;
   let error;
+  let iframePort;
 
   function unhandledrejectionCallback(ev) {
     notcalled = false;
@@ -40,7 +41,13 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
     this.ifr.sandbox.add("allow-scripts", "allow-same-origin");
     this.ifr.src = "/base/tests/fixtures/v430comlink.html";
     document.body.appendChild(this.ifr);
-    return new Promise((resolve) => (this.ifr.onload = resolve));
+    return new Promise((resolve) => (this.ifr.onload = resolve)).then(() => {
+      const iframeChannel = new MessageChannel();
+      iframePort = iframeChannel.port1;
+      this.ifr.contentWindow.postMessage(iframeChannel.port2, "*", [
+        iframeChannel.port2,
+      ]);
+    });
   });
 
   afterEach(function () {
@@ -53,7 +60,7 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
   });
 
   it("can send a proxy and call a function", async function () {
-    const iframe = Comlink.windowEndpoint(this.ifr.contentWindow);
+    const iframe = iframePort;
     const latest = Comlink.wrap(iframe);
 
     expect(await latest.acceptProxy(Comlink.proxy(() => 3))).to.equal(4);
@@ -62,7 +69,7 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
   });
 
   it("can send port that get wrapped and transfer by argument", async function () {
-    const iframe = Comlink.windowEndpoint(this.ifr.contentWindow);
+    const iframe = iframePort;
     const latest = Comlink.wrap(iframe);
     let maybecalled = false;
     class Test {
@@ -82,7 +89,7 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
 
   it("can send port that get wrapped and transfer by a setter", async function () {
     // Verify that it also works with a setter
-    const iframe = Comlink.windowEndpoint(this.ifr.contentWindow);
+    const iframe = iframePort;
     const latest = Comlink.wrap(iframe);
     const channel2 = new MessageChannel();
     let risecalled = false;
@@ -104,7 +111,7 @@ describe("Comlink across versions (4.3.0 to latest main)", function () {
   });
 
   it("works with custom handlers", async function () {
-    const iframe = Comlink.windowEndpoint(this.ifr.contentWindow);
+    const iframe = iframePort;
     const proxy = Comlink.wrap(iframe);
 
     Comlink.transferHandlers.set("pingpong", {