fix(import): extend cross-origin MessageChannel validation to import frame [INT-783][ENG-4597][ENG-4598] - #130
Merged
justinformentin merged 3 commits intoAug 14, 2026
Conversation
… import frame Mirrors the TURNKEY_INIT_MESSAGE_CHANNEL gate added to export-and-sign in PR #129 (#129). The import frame's handler previously only checked event.ports?.[0]; it now also validates: - event.source === window.parent (direct parent only) - event.origin && event.origin !== "null" (concrete, non-opaque origin) - event.ports?.length === 1 (exactly one transferred port) Closes the identical class of vulnerability INT-697 fixed in export-and-sign. Pre-existing gap; not introduced by PR #129. Also adds six Jest tests for the new gate conditions and rebuilds the production bundle (content hash: 45de86a592cd0d80ccd0). Linear: INT-783 https://linear.app/turnkey/issue/INT-783
justinformentin
force-pushed
the
jf/int-783-import-frame-apply-cross-origin-messagechannel-validation
branch
from
August 7, 2026 19:07
207de18 to
f1647ae
Compare
justinformentin
changed the title
…ing (ENG-4597) Previously, onInjectImportBundle() in the v1.0.0 path would only log a console.warn when organizationId or userId was omitted by the caller, allowing signed import bundles to be accepted without org/user binding. This change converts both warnings into hard errors: - Missing organizationId → throws with message indicating iframe-stamper >= v2.0.0 is required - Missing userId → throws with same guidance The existing equality checks (signedData must match the supplied values) are preserved unchanged. The now-obsolete TODO comments and console.warn calls are removed. Tests: new describe block 'onInjectImportBundle org/user binding (import frame)' in import/index.test.js covers: - missing organizationId (undefined and empty string) - missing userId (undefined and empty string) - mismatched organizationId / userId still throws - valid matching bundle succeeds (BUNDLE_INJECTED) Bundle rebuilt: index.bundle.808edbe601034931b90e.js
justinformentin
force-pushed
the
jf/int-783-import-frame-apply-cross-origin-messagechannel-validation
branch
from
August 10, 2026 15:03
1a7b31a to
e0a04e0
Compare
fainashalts
requested changes
Aug 10, 2026
fainashalts
left a comment
fainashalts
left a comment
Contributor
There was a problem hiding this comment.
The MessageChannel gate itself looks correct. Left a blocking comment but otherwise looks good!
| event.data && | ||
| event.data["type"] == "TURNKEY_INIT_MESSAGE_CHANNEL" && | ||
| event.ports?.[0] | ||
| event.source === window.parent && |
Contributor
There was a problem hiding this comment.
this validates only the MessageChannel handshake. The legacy listener registered in DOMContentLoaded still attaches messageEventListener directly, so until a channel is established INJECT_IMPORT_BUNDLE, EXTRACT_* and APPLY_SETTINGS accept messages from any source or origin if I'm reading this right.
The new org/user checks don't close this path because those expected values come from the same untrusted message. A non-parent sender can provide a valid signed bundle with matching IDs and overwrite the persisted target key or trigger extraction/reset operatioons.
Should mirror #129's legacy wrapper: require the direct parent, reject empty/opaque origins, bind subsequent traffic to the first accepted origin, and restrict responses to that origin. Should also add regression tests for operational messages from non-parent and opaque-origin senders.
…igin messages Mirror PR #129's export-and-sign pattern to the import frame's legacy window.message listener (the path used by @turnkey/iframe-stamper < 2.1.0): 1. Require event.source === window.parent (direct parent only) 2. Reject empty and opaque ('null') origins 3. Bind legacyParentOrigin on the first accepted message; drop later messages from any other origin 4. Call TKHQ.setParentFrameOrigin(event.origin) on first bind so outbound window.parent.postMessage responses are scoped to that origin instead of '*' 5. Skip TURNKEY_INIT_MESSAGE_CHANNEL messages in the legacy listener (owned by the MessageChannel handshake handler) Also export setParentFrameOrigin from import/src/turnkey-core.js and add modulePaths to jest.config.js so @shared/* deps (bech32, etc.) can be resolved from import/node_modules. Adds 11 regression tests in 'Legacy listener cross-origin gate (import frame)' covering: non-parent sender, opaque origin, empty origin, second-origin-after-binding, origin binding/idempotency, and valid parent acceptance. Rebuilds dist bundles.
justinformentin
force-pushed
the
jf/int-783-import-frame-apply-cross-origin-messagechannel-validation
branch
from
August 11, 2026 14:46
126d5ae to
ec45a90
Compare
fainashalts
approved these changes
Aug 11, 2026
fainashalts
left a comment
fainashalts
left a comment
Contributor
There was a problem hiding this comment.
Re-reviewed at ec45a90. Legacy message path is now source/origin-gated, origin-bound, and covered by regression tests. My previous blocker is resolved; no additional blocking issues found.
justinformentin
deleted the
jf/int-783-import-frame-apply-cross-origin-messagechannel-validation
branch
August 14, 2026 15:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the INT-697 / #129 cross-origin hardening to the import frame, which #129 didn't touch.
Linear: INT-783 · ENG-4598 · ENG-4597
Changes
TURNKEY_INIT_MESSAGE_CHANNELgate (ENG-4598) — anyone could seize the channel. Now requiresevent.source === window.parent, a non-opaque origin, and exactly one port.Legacy
postMessagepath — the pre-MessageChannel path (iframe-stamper < 2.1.0) had no sender checks at all. Same parent/origin checks, plus it binds the first accepted origin and drops anything from a different one. Responses go to the bound origin instead of*.Import bundle org/user binding (ENG-4597) —
onInjectImportBundleonlyconsole.warn'd whenorganizationId/userIdwere missing, so legacy callers skipped the binding check entirely. Both now throw.Testing
39 tests pass, lint/prettier clean, build OK. New tests cover the channel gate, the legacy origin binding, and the org/user rejections. Also added
modulePathstojest.config.jsso@shared/*imports resolve their own deps.