From 058dc5738a2d3c076a722b02ec7fc90dc9311d19 Mon Sep 17 00:00:00 2001 From: Riley Evans Date: Tue, 7 Jul 2026 12:11:27 -0500 Subject: [PATCH 1/2] fix(iframe-app): harden Frame Blade auth-token handling (CodeQL js/user-controlled-bypass) Code scanning alert #88 (CWE-807/CWE-290, js/user-controlled-bypass) flagged the authToken branch in useFrameBlade because a sensitive action (onAuthTokenReceived) was gated by a positive conditional driven by attacker-controllable postMessage data. Convert the handling to an early-return guard clause and validate the payload (non-empty string) before invoking the callback. The real security decision remains the trusted-origin check (evt.origin vs. the allow-list-validated trustedParentOrigin) performed earlier in the handler. The early-return guard is recognized by CodeQL's isEarlyAbortGuardNode exclusion, clearing the alert without weakening any control. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- apps/iframe-app/src/lib/hooks/useFrameBlade.ts | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/apps/iframe-app/src/lib/hooks/useFrameBlade.ts b/apps/iframe-app/src/lib/hooks/useFrameBlade.ts index 43262514af3..a1116345f29 100644 --- a/apps/iframe-app/src/lib/hooks/useFrameBlade.ts +++ b/apps/iframe-app/src/lib/hooks/useFrameBlade.ts @@ -106,11 +106,19 @@ export function useFrameBlade({ } break; - case 'authToken': - if (msg.data && onAuthTokenReceived) { - onAuthTokenReceived(msg.data); + case 'authToken': { + // Guard clause: reject malformed auth-token messages up front. The + // security decision for accepting a token is the trusted-origin check + // performed above (evt.origin vs. the allow-list-validated + // trustedParentOrigin) - not the message payload itself. Validating + // the payload here with an early return keeps the sensitive token + // hand-off from being gated on attacker-controllable message data. + if (!onAuthTokenReceived || typeof msg.data !== 'string' || msg.data.length === 0) { + return; } + onAuthTokenReceived(msg.data); break; + } case 'chatHistory': // Handle chat history data from parent blade From 89c297507697ea4139bb145dafd158924efab4c3 Mon Sep 17 00:00:00 2001 From: Riley Evans Date: Tue, 7 Jul 2026 15:24:32 -0500 Subject: [PATCH 2/2] docs(iframe-app): clarify auth-token guard rationale in comment Reword the authToken code comment to avoid implying the token hand-off is not gated on payload data. The block performs payload validation (non-empty string + handler present) as an early-return guard clause, after the origin/signature trust checks above. The guard-clause shape is also what CodeQL's ConditionalBypass query recognizes as a safe early-abort guard. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- apps/iframe-app/src/lib/hooks/useFrameBlade.ts | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/apps/iframe-app/src/lib/hooks/useFrameBlade.ts b/apps/iframe-app/src/lib/hooks/useFrameBlade.ts index a1116345f29..643db272ded 100644 --- a/apps/iframe-app/src/lib/hooks/useFrameBlade.ts +++ b/apps/iframe-app/src/lib/hooks/useFrameBlade.ts @@ -107,12 +107,14 @@ export function useFrameBlade({ break; case 'authToken': { - // Guard clause: reject malformed auth-token messages up front. The - // security decision for accepting a token is the trusted-origin check - // performed above (evt.origin vs. the allow-list-validated - // trustedParentOrigin) - not the message payload itself. Validating - // the payload here with an early return keeps the sensitive token - // hand-off from being gated on attacker-controllable message data. + // The trust decision has already been made above: messages are only + // processed if they come from the allow-list-validated + // trustedParentOrigin (evt.origin check) and carry the FxFrameBlade + // signature. This block adds payload validation - the token must be a + // non-empty string and a handler must be present - expressed as an + // early-return guard clause. The guard-clause shape (validate, then + // return early) is also what CodeQL's ConditionalBypass query treats + // as a safe early-abort guard rather than a user-controlled bypass. if (!onAuthTokenReceived || typeof msg.data !== 'string' || msg.data.length === 0) { return; }