fix: sanitize AI review HTML and verify iframe postMessage origin

lib/components/AiReviewDialog/ViewAiReviewView.tsx

@@ -2,6 +2,7 @@ import { useEffect, useMemo, useState } from "react"
 import { Button } from "../ui/button"
 import { DialogHeader, DialogTitle } from "../ui/dialog"
 import { marked } from "marked"
+import DOMPurify from "dompurify"
 import type { AiReview } from "./types"
 import { getRegistryKy } from "lib/utils/get-registry-ky"
 
@@ -50,7 +51,8 @@ export const AiReviewViewView = ({
   }, [aiReviewId])
 
   const html = useMemo(
-    () => marked.parse(review.ai_review_text || "") as string,
+    () =>
+      DOMPurify.sanitize(marked.parse(review.ai_review_text || "") as string),
     [review.ai_review_text],
   )
   return (

lib/components/RunFrameWithIframe/RunFrameWithIframe.tsx

@@ -4,6 +4,7 @@
  */
 import { useEffect, useRef } from "react"
 import type { RunFrameProps } from "../RunFrame/RunFrameProps"
+import { resolveIframeTargetOrigin } from "lib/utils/resolve-iframe-target-origin"
 
 export interface RunFrameWithIframeProps extends RunFrameProps {
   iframeUrl?: string
@@ -16,14 +17,23 @@ export const RunFrameWithIframe = ({
   const iframeRef = useRef<HTMLIFrameElement>(null)
 
   useEffect(() => {
+    const targetOrigin = resolveIframeTargetOrigin(
+      iframeUrl,
+      window.location.href,
+    )
+
     const handleMessage = (event: MessageEvent) => {
+      // Only respond to the ready signal coming from our own iframe, and never
+      // broadcast the props to an unknown origin.
+      if (event.source !== iframeRef.current?.contentWindow) return
+      if (!targetOrigin) return
       if (event.data?.runframe_type === "runframe_ready_to_receive") {
         iframeRef.current?.contentWindow?.postMessage(
           {
             runframe_type: "runframe_props_changed",
             runframe_props: runFrameProps,
           },
-          "*",
+          targetOrigin,
         )
       }
     }

lib/utils/resolve-iframe-target-origin.ts

@@ -0,0 +1,20 @@
+/**
+ * Resolve the origin to use as the `targetOrigin` argument of
+ * `window.postMessage`. Using a specific origin (instead of "*") prevents the
+ * message payload from leaking to any page that happens to embed the iframe.
+ *
+ * `iframeUrl` may be absolute (e.g. "https://runframe.tscircuit.com/iframe.html")
+ * or relative (e.g. "/iframe.html"), so it is resolved against `baseUrl` before
+ * extracting the origin. Returns `null` when the URL cannot be parsed, letting
+ * callers decide how to handle the failure safely.
+ */
+export const resolveIframeTargetOrigin = (
+  iframeUrl: string,
+  baseUrl?: string,
+): string | null => {
+  try {
+    return new URL(iframeUrl, baseUrl).origin
+  } catch {
+    return null
+  }
+}

package.json

@@ -114,6 +114,7 @@
   },
   "dependencies": {
     "@tscircuit/eval": "^0.0.874",
-    "@tscircuit/solver-utils": "^0.0.7"
+    "@tscircuit/solver-utils": "^0.0.7",
+    "dompurify": "^3.4.7"
   }
 }

tests/resolve-iframe-target-origin.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test"
+import { resolveIframeTargetOrigin } from "../lib/utils/resolve-iframe-target-origin"
+
+describe("resolveIframeTargetOrigin", () => {
+  test("returns the origin of an absolute iframe url", () => {
+    expect(
+      resolveIframeTargetOrigin("https://runframe.tscircuit.com/iframe.html"),
+    ).toBe("https://runframe.tscircuit.com")
+  })
+
+  test("strips path, query and hash, keeping only the origin", () => {
+    expect(
+      resolveIframeTargetOrigin("https://example.com:8080/a/b?c=1#d"),
+    ).toBe("https://example.com:8080")
+  })
+
+  test("resolves a relative url against the base url", () => {
+    expect(
+      resolveIframeTargetOrigin("/iframe.html", "https://app.tscircuit.com/x"),
+    ).toBe("https://app.tscircuit.com")
+  })
+
+  test("returns null for an unparseable url", () => {
+    expect(resolveIframeTargetOrigin("not a url")).toBeNull()
+  })
+
+  test("never returns the wildcard origin", () => {
+    expect(
+      resolveIframeTargetOrigin("https://runframe.tscircuit.com/iframe.html"),
+    ).not.toBe("*")
+  })
+})