Insufficient postMessage Validation

[burgil]

Insufficient postMessage Validation

The origin of the received message is not checked. This means any site (even malicious) can send message to this window. If you don't expect this, consider checking the origin of sender.

peerjs.js (line : 4232)

this.dataChannel.addEventListener("message", (e) =>this._handleDataMessage(e));

Fix Analysis

Details

postMessage is a feature to perform cross-origin communication between JavaScript Window objects. This can be done by:

• The sender using the targetWindow.postMessage(message, targetOrigin) to send a message to the targetWindow but only if the origin in that window matches targetOrigin (or if targetOrigin is set to the special value *);

• The receiver listening for the message event in the window object.

However, if no validation is done by the receiver, this could allow any window to send arbitrary data to the handler. This vulnerability could be leveraged by an attacker to disclose sensitive data to a malicious origin, or perform actions on a vicitim's behalf.

Example:

          window.addEventListener("message", (event) => {
              // DANGEROUS: No validation of origin
              doStuff(event.data);
          });

Best practices for prevention

• Adopt a zero-trust model in which all input is considered potentially suspect.
• Specify the targetOrigin instead of designating a wildcard *.

Example:

window.addEventListener("message", (event) => {
              if (event.origin !== "http://example.org") // SAFE: origin checked
                  return;
          
              console.log(event.data)
          });

References

Introduction to postMessage() Vulnerabilities

[burgil]

Hi, Is there a way I can use to fix/mute this warning in snyk please?

[jonasgloning]

Snyk seems to confuse a PeerJS data channel with a multi-window message exchange. This is definitely a false positive. There’s probably a way to mute that in Snyk directly, but you can also just replace `.addEventListener("message",...)` with `.on("message", ...)`