3 ms·
I don't understand the testcase they provide. It opens a window at https://ssl.comodo.com/ https://ssl.comodo.com/ and sends a message to it with `postMessage`.
by twiss 11y ago
I don't understand the testcase they provide. It opens a window at https://ssl.comodo.com/ https://ssl.comodo.com/ and sends a message to it with `postMessage`. However, the whole point of postMessage is to provide cross-origin communication. Continuing, the message they send is:
{
command: "execCode",
code: "alert(document.cookie)",
}
Apparently https://ssl.comodo.com/ https://ssl.comodo.com/ used to then proceed to execute that code. However, this is not a vulnerability in the browser, but in that website. Am I missing something? Was Chromodo breaking the `messageEvent.origin` property, breaking same-origin checks in JavaScript? Seems far-fetched.
- lolc 11y agoWhat postMessage() does is immaterial. This is where it should fail, referencing into another domain: obj.postMessage
- twiss 11y agoNo, that shouldn't fail. `postMessage` is not a random function defined inside the window at ssl.comodo.com. It's a function defined by the browser, available on every Window object, including ones returned by window.open(): https://developer.mozilla.org/docs/Web/API/Window/postMessage https://developer.mozilla.org/docs/Web/API/Window/postMessag...
- lolc 11y agoThanks for the correction. I didn't know postMessage() was special. Now I too am confused as to why the browser should be to blame here.