diff --git a/app/client/src/entities/DataTree/actionTriggers.ts b/app/client/src/entities/DataTree/actionTriggers.ts index 54f118143a..d951a76fb6 100644 --- a/app/client/src/entities/DataTree/actionTriggers.ts +++ b/app/client/src/entities/DataTree/actionTriggers.ts @@ -171,7 +171,7 @@ export type ConfirmationModal = { export type PostMessageDescription = { type: ActionTriggerType.POST_MESSAGE; payload: { - message: any; + message: unknown; targetOrigin: string; }; }; diff --git a/app/client/src/sagas/ActionExecution/PostMessageSaga.ts b/app/client/src/sagas/ActionExecution/PostMessageSaga.ts index 2521a6b401..181453921c 100644 --- a/app/client/src/sagas/ActionExecution/PostMessageSaga.ts +++ b/app/client/src/sagas/ActionExecution/PostMessageSaga.ts @@ -1,6 +1,9 @@ import { spawn } from "redux-saga/effects"; import { PostMessageDescription } from "../../entities/DataTree/actionTriggers"; -import { logActionExecutionError } from "sagas/ActionExecution/errorUtils"; +import { + logActionExecutionError, + TriggerFailureError, +} from "sagas/ActionExecution/errorUtils"; import { TriggerMeta } from "./ActionExecutionSagas"; export function* postMessageSaga( @@ -16,7 +19,15 @@ export function* executePostMessage( ) { const { message, targetOrigin } = payload; try { - window.parent.postMessage(message, targetOrigin, undefined); + if (targetOrigin === "*") { + throw new TriggerFailureError( + "Please enter a valid url as targetOrigin. Failing to provide a specific target discloses the data you send to any interested malicious site.", + ); + } else if (!message) { + throw new TriggerFailureError("Please enter a message."); + } else { + window.parent.postMessage(message, targetOrigin, undefined); + } } catch (error) { logActionExecutionError( error.message, diff --git a/app/client/src/utils/autocomplete/EntityDefinitions.ts b/app/client/src/utils/autocomplete/EntityDefinitions.ts index baef8e9b5c..c56e9c855c 100644 --- a/app/client/src/utils/autocomplete/EntityDefinitions.ts +++ b/app/client/src/utils/autocomplete/EntityDefinitions.ts @@ -673,7 +673,7 @@ export const GLOBAL_FUNCTIONS = { postMessageToTargetWindow: { "!doc": "Establish cross-origin communication between Window objects/page and iframes", - "!type": "fn(message: any, targetOrigin: string, transfer: [any])", + "!type": "fn(message: unknown, targetOrigin: string, transfer: [any])", }, };