Check origin for postMessage

Author: catarak

client/modules/IDE/components/ConsoleInput.jsx

@@ -28,6 +28,9 @@ class ConsoleInput extends React.Component {
         if (value.trim(' ') === '') {
           return false;
         }
+        // need to get access to iframe here?
+        // could pass "evaluate console function"
+        // could make a component that handles all of this messaging
         window.postMessage([{
           log: Encode({ method: 'command', data: Encode(value) }),
           source: 'console'

client/modules/IDE/components/PreviewFrame.jsx

@@ -70,6 +70,7 @@ class PreviewFrame extends React.Component {
   }
 
   handleConsoleEvent(messageEvent) {
+    if (messageEvent.origin !== window.origin) return;
     if (Array.isArray(messageEvent.data)) {
       const decodedMessages = messageEvent.data.map(message => Object.assign(
         Decode(message.log),

client/utils/previewEntry.js

@@ -13,7 +13,7 @@ Hook(window.console, (log) => {
 });
 setInterval(() => {
   if (consoleBuffer.length > 0) {
-    window.parent.postMessage(consoleBuffer, '*');
+    window.parent.postMessage(consoleBuffer, window.origin);
     consoleBuffer.length = 0;
   }
 }, LOGWAIT);