Andrey Antukh 20e67af9f6 🐛 Fix plugin postMessage channel allowing cross-plugin message injection ...

The global postMessage listener was broadcasting incoming messages to all
loaded plugins without validating the origin or routing to the correct
sender. This allowed any plugin (or any iframe from any origin) to inject
messages into other plugins.

- Added origin validation — messages from origins other than
  window.location.origin are rejected.
- Added sender-based routing — a message is only delivered to the plugin
  whose iframe contentWindow matches event.source.
- Exposed iframeWindow getters in PluginManager, PluginModalElement, and
  createPlugin so the runtime can compare event.source against the correct
  iframe reference.
- Updated documentation examples to include origin validation and
  recommend window.location.origin over '*' for postMessage targetOrigin.

AI-assisted-by: qwen3.7-plus

2026-07-30 12:18:17 +00:00

..

api.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

beta-changelog.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

create-a-plugin.md

🐛 Fix plugin postMessage channel allowing cross-plugin message injection

2026-07-30 12:18:17 +00:00

deployment.md

📚 Improve plugin deployment documentation (#10544)

2026-07-20 11:55:36 +02:00

examples-templates.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

faq.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

getting-started.md

📚 Clarify manifest version 2 for relative plugin asset paths (#8992)

2026-04-15 10:38:53 +02:00

index.njk

📚 Improve metadata descriptions (#6457)

2025-05-13 08:09:59 +02:00