0 Fork 0

mirror of https://github.com/HeyPuter/vscode-web-puter.git synced 2026-11-13 18:35:09 -10:00

T

Neal Shah 9773d102ce security: add origin validation to Comlink message handler in service worker (#2 )

Prevents cross-origin pages from establishing a Comlink bridge to access
the authToken and other sensitive data from the authenticated Puter SDK.

The vulnerability allowed an attacker to:
1. Open puter.com/app/code in a popup from their own origin
2. Use Comlink's windowEndpoint with wildcard origin ('*') to intercept messages
3. Capture the unscoped GUI credential and mint full-access tokens
4. Access victim's private files and accounts

This fix validates that message events only come from the same origin as the
service worker before accepting the MessagePort. Untrusted messages are rejected
and logged to console.

Fixes exploitation demonstrated in external security test case.

2026-09-25 17:25:39 -04:00

.github/workflows

first commit

2026-02-03 15:43:56 -08:00

myDav

Move authConfigured check above client creation

2026-05-07 18:44:57 -04:00

myExt

first commit

2026-02-03 15:43:56 -08:00

.gitignore

more build changes