Fix DOM XSS

hakimel · Feb 26, 2022 · 32cdd3b · 32cdd3b
1 parent e33c3c7
commit 32cdd3b
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/plugin/notes/speaker-view.html b/plugin/notes/speaker-view.html
@@ -368,6 +368,10 @@ <h4 class="label">Notes</h4>
 
 				window.addEventListener( 'message', function( event ) {
 
+					if (window.location.origin !== event.origin){
+						return;
+					}
+
 					clearTimeout( connectionTimeout );
 					connectionStatus.style.display = 'none';