fix(security): bind iframe messages and token replies to trusted peers (LUNA-003)

Author: Aaron3S

scripts/security-checks.mjs

@@ -32,3 +32,35 @@ assert.equal(interpolate('{{jms_null}}', {jms_null: null}), '');
 assert.throws(() => interpolate('{{constructor}}', {}));
 assert.throws(() => interpolate('{{jms_missing}}', {}));
 console.log('Command interpolation controls passed (no evaluation or recursive substitution)');
+
+const frameJS = ts.transpileModule(fs.readFileSync('src/app/elements/iframe/iframe.component.ts', 'utf8'), {
+  compilerOptions: {module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020, experimentalDecorators: true}
+}).outputText;
+class Emitter {events = []; emit(value) {this.events.push(value);}}
+class Subject {pipe() {return {subscribe() {}};} next() {}}
+const decorator = () => () => {};
+const angular = {EventEmitter: Emitter, Component: decorator, Input: decorator, Output: decorator, ViewChild: decorator};
+const frameSandbox = {exports: {}, URL, window: {location: {href: 'https://luna.example/luna/'}},
+  require(name) {if (name === '@angular/core') return angular; if (name === 'rxjs') return {Subject}; return {};}};
+vm.runInNewContext(frameJS, frameSandbox);
+const Frame = frameSandbox.exports.ElementIframeComponent;
+const frame = new Frame();
+const sent = [];
+const peer = {postMessage(message, origin) {sent.push({message, origin});}};
+frame.src = 'https://koko.example:8443/koko/connect/?token=secret';
+frame.id = 'window-test';
+frame.view = {};
+frame.iframeRef = {nativeElement: {contentWindow: peer}};
+frame.handleIframeEvent = () => {};
+frame.ngAfterViewInit();
+for (const e of [
+  {source: {}, origin: 'https://koko.example:8443'},
+  {source: peer, origin: 'https://attacker.example'},
+  {source: peer, origin: 'https://koko.example'},
+]) frame.eventHandler({...e, data: {id: frame.id, name: 'CREATE_FILE_CONNECT_TOKEN'}});
+assert.equal(frame.createFileConnectToken.events.length, 0);
+frame.eventHandler({source: peer, origin: 'https://koko.example:8443', data: {id: frame.id, name: 'CREATE_FILE_CONNECT_TOKEN'}});
+assert.equal(frame.createFileConnectToken.events.length, 1);
+frame.eventHandler({source: peer, origin: 'https://koko.example:8443', data: {id: frame.id, name: 'PING'}});
+assert.equal(sent[0].origin, 'https://koko.example:8443');
+console.log('Iframe message source/origin/port and outgoing target controls passed');

src/app/elements/content/content-window/koko/koko.component.ts

@@ -68,16 +68,18 @@ export class ElementConnectorKokoComponent implements OnInit {
 
   async createFileConnectToken(evt) {
     const iframeWindow = (this.iframeRef as unknown as { iframeWindow: Window }).iframeWindow;
+    const targetURL = this.iframeURL;
+    const targetOrigin = new URL(targetURL, window.location.href).origin;
     const oldConnectToken = this.view.connectToken;
     const newConnectToken = await this._connectTokenSvc.exchange(oldConnectToken);
 
-    if (!newConnectToken) {
+    if (!newConnectToken || this.iframeURL !== targetURL) {
       return;
     }
 
     iframeWindow.postMessage(
       { name: 'GET_FILE_CONNECT_TOKEN', token: newConnectToken.id },
-      '*'
+      targetOrigin
     );
   }
 

src/app/elements/iframe/iframe.component.ts

@@ -88,15 +88,19 @@ export class ElementIframeComponent implements OnInit, AfterViewInit, OnDestroy
     this.view.iframeElement = this.iframeWindow;
 
     this.eventHandler = function (e: any) {
+      if (e.source !== this.iframeWindow || e.origin !== this.getIframeOrigin()) {
+        return;
+      }
       const msg = e.data;
+      if (!msg || typeof msg !== 'object') return;
 
       if (msg.id !== this.id) {
         return;
       }
 
       switch (msg.name) {
         case 'PING': {
-          this.iframeWindow.postMessage({ name: 'PONG', id: this.id }, '*');
+          this.postToIframe({ name: 'PONG', id: this.id });
           break;
         }
         case 'PONG':
@@ -166,14 +170,30 @@ export class ElementIframeComponent implements OnInit, AfterViewInit, OnDestroy
     this.handleIframeEvent();
   }
 
+  private getIframeOrigin(): string | null {
+    try {
+      const url = new URL(this.src, window.location.href);
+      return ['http:', 'https:'].includes(url.protocol) ? url.origin : null;
+    } catch {
+      return null;
+    }
+  }
+
+  private postToIframe(message: unknown): void {
+    const origin = this.getIframeOrigin();
+    if (origin && this.iframeWindow) {
+      this.iframeWindow.postMessage(message, origin);
+    }
+  }
+
   ngOnDestroy() {
     window.removeEventListener('message', this.eventHandler);
     this.subscription.unsubscribe();
   }
 
   setActive() {
     this._logger.debug(`[Luna] Send FOCUS to: ${this.id}`);
-    this.iframeWindow.postMessage({ name: 'FOCUS' }, '*');
+    this.postToIframe({ name: 'FOCUS' });
   }
 
   handleIframeEvent() {
@@ -187,7 +207,7 @@ export class ElementIframeComponent implements OnInit, AfterViewInit, OnDestroy
     // @ts-ignore
     this.ping = setInterval(() => {
       this._logger.info(`[Luna] Send PING to: ${this.id}`);
-      this.iframeWindow.postMessage({ name: 'PING', id: this.id, disbaleFileManager }, '*');
+      this.postToIframe({ name: 'PING', id: this.id, disbaleFileManager });
     }, 500);
 
     // 30s 内未PING通, 则主动关闭
@@ -201,15 +221,15 @@ export class ElementIframeComponent implements OnInit, AfterViewInit, OnDestroy
 
     this.subscription = this._iframeSvc.message$.subscribe(message => {
       // this._logger.info('[Luna] Send msg to iframe: ', message);
-      this.iframeWindow.postMessage(message, '*');
+      this.postToIframe(message);
     });
 
     window.addEventListener('message', this.eventHandler);
   }
 
   sendCommand(data) {
     this._logger.info(`[Luna] Send CMD to: ${this.id}`);
-    this.iframeWindow.postMessage({ name: 'CMD', data: data.data }, '*');
+    this.postToIframe({ name: 'CMD', data: data.data });
   }
 
   // 没有位置用啊
@@ -252,7 +272,7 @@ export class ElementIframeComponent implements OnInit, AfterViewInit, OnDestroy
 
   sendInputActive() {
     this._logger.info(`[Luna] Send Input_ACTIVE to: ${this.id}`);
-    this.iframeWindow.postMessage({ name: 'INPUT_ACTIVE', data: "" }, '*');
+    this.postToIframe({ name: 'INPUT_ACTIVE', data: "" });
   }
 
   sendInputActiveToOtherViews() {