JS - iframe postMessage API

by Zacc206

JavaScript

(function(){
  const whitelist = [
    "http://a.b.c.d",
    "http://w.x.y.z"
  ];

  window.onload = function(){
    function receiveMessage(evt){
      // Validate origin against whitelist to prevent against injection attacks from unknown domains
      if(!containsAny([evt.origin], whitelist)){
        return;
      }

      var result = {};

      switch(evt.data.action)
      {
        case "getHeight":
          result.action = "setHeight";
          result.height = document.getElementsByTagName('html')[0].scrollHeight;
          result.elemId = evt.data.elemId;
          break;
        default:
          break;
      }

      evt.source.postMessage(result, event.origin);
    }

    window.addEventListener("message", receiveMessage, false);
  };

  function sanitizeObj(obj){
    for(var key in obj){
      if(obj.hasOwnProperty(key)){
        if(typeof obj[key] === "string"){
          obj[key] = escapeHtml(obj[key]);
        }
      }
    }
    return obj;
  }

  function escapeHtml(unsafe) {
      return unsafe
           .replace(/&/g, "&")
           .replace(/</g, "&lt;")
           .replace(/>/g, "&gt;")
           .replace(/"/g, "&quot;")
           .replace(/'/g, "&#039;");
   }

  function containsAny(source,target){
  	var result = source.filter(function(item){return target.indexOf(item) > -1});
  	return (result.length > 0);
  }

})();