Add origin check to events

[C0rby]

This event listener should check the event's origin.

web/packages/web-app-draw-io/src/App.vue

Lines 75 to 93 in 37e83b0

	window.addEventListener('message', (event) => {
	if (event.data.length > 0) {
	const payload = JSON.parse(event.data)
	switch (payload.event) {
	case 'init':
	this.fileExtension === 'vsdx' ? this.importVisio() : this.load()
	break
	case 'autosave':
	this.save(payload, true)
	break
	case 'save':
	this.save(payload)
	break
	case 'exit':
	this.exit()
	break
	}
	}
	})

And these lines should contain the target origin:

web/packages/web-app-draw-io/src/App.vue

Line 118 in 37e83b0

'*'

web/packages/web-app-draw-io/src/App.vue

Line 145 in 37e83b0

'*'

web/packages/web-app-draw-io/src/App.vue

Line 186 in 37e83b0

'*'

web/packages/web-app-draw-io/src/App.vue

Line 211 in 37e83b0

'*'

See this for more information: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns
If you want a demo of a poc exploit, just ping me. :)

[JammingBen]

This has been fixed via #7941 in the stable-6.0 branch. Will come to master soon.