Luke Wilde 079c28d5e6 LibWeb: Make MessageEvents from {Window,MessagePort}.postMessage trusted ...

The MessagePort one in particular is required by Cloudflare Turnstile,
as the method it takes to run JS in a worker is to `eval` the contents
of `MessageEvent.data`. However, it will only do this if
`MessageEvent.isTrusted` is true, `MessageEvent.origin` is the empty
string and `MessageEvent.source` is `null`.

The Window version is a quick fix whilst in the vicinity, as its
MessageEvent should also be trusted.

2024-11-15 18:50:08 +01:00

18 KiB

Raw Blame History

View Raw