postMessage targetOrigin is not validated in hydra.js — XSS-capable page can spoof edit data

[saismrutiranjan18]

Security — postMessage origin not validated in hydra.js bridge

Problem

The hydra.js message event listener may not validate event.origin against the known Hydra admin origin. This allows any script on the same browser session to send spoofed edit payloads to the frontend iframe, injecting malicious content into the CMS.

The fix is straightforward

The expected Hydra origin is already encoded in window.name = 'hydra-edit:<origin>':

const hydraOrigin = window.name.split(':').slice(1).join(':');
window.addEventListener('message', (event) => {
  if (event.origin !== hydraOrigin) return; // reject unknown origins
  // process event.data
});

Audit request

Please audit ALL addEventListener('message', ...) handlers in hydra.js to confirm origin validation is applied consistently.

Labels

security, bug