fix(social-source): use specified target origin for social source postMessage call

Author: nd0ut

src/blocks/ExternalSource/ExternalSource.ts

@@ -267,7 +267,7 @@ export class ExternalSource extends UploaderBlock {
 
     this._messageBridge?.destroy();
 
-    this._messageBridge = new MessageBridge(iframe.contentWindow);
+    this._messageBridge = new MessageBridge(iframe.contentWindow, () => this.cfg.socialBaseUrl);
     this._messageBridge.on('selected-files-change', this.handleSelectedFilesChange.bind(this));
     this._messageBridge.on('toolbar-state-change', this.handleToolbarStateChange.bind(this));
 

src/blocks/ExternalSource/MessageBridge.ts

@@ -15,12 +15,15 @@ const isWhitelistedMessage = (message: unknown): message is InputMessageMap[Inpu
 };
 
 export class MessageBridge {
-  _handlerMap = new Map<InputMessageType, Set<InputMessageHandler<InputMessageType>>>();
+  private _handlerMap = new Map<InputMessageType, Set<InputMessageHandler<InputMessageType>>>();
 
-  _context: Window;
+  private _context: Window;
 
-  constructor(context: Window) {
+  private _getTargetOrigin: () => string;
+
+  constructor(context: Window, getTargetOrigin: () => string) {
     this._context = context;
+    this._getTargetOrigin = getTargetOrigin;
 
     window.addEventListener('message', this._handleMessage);
   }
@@ -52,7 +55,8 @@ export class MessageBridge {
   }
 
   send(message: OutputMessage) {
-    this._context.postMessage(message, '*');
+    const targetOrigin = this._getTargetOrigin();
+    this._context.postMessage(message, targetOrigin);
   }
 
   destroy() {