Luke Wilde a7b4b170ed LibWeb: Make MessageEvents from {Window,MessagePort}.postMessage trusted ...

The MessagePort one in particular is required by Cloudflare Turnstile,
as the method it takes to run JS in a worker is to `eval` the contents
of `MessageEvent.data`. However, it will only do this if
`MessageEvent.isTrusted` is true, `MessageEvent.origin` is the empty
string and `MessageEvent.source` is `null`.

The Window version is a quick fix whilst in the vicinity, as its
MessageEvent should also be trusted.

(cherry picked from commit 079c28d5e68ad983340c02f3d043acfdf2846d18)

2024-11-17 15:18:20 -05:00

17 KiB

Raw Blame History

View Raw