fix(web-pkg): [OCISDEV-777] validate postMessage origin in embed mode…

[awabcodes]

… modals

Description

The embed mode modals (SaveAsModal, ExportAsPdfModal, FilePickerModal) registered global window message listeners and acted on incoming owncloud-embed:* messages without validating event.origin. Any page holding a reference to an authenticated ownCloud window (e.g. via window.open) could forge an owncloud-embed:select, owncloud-embed:file-pick or owncloud-embed:cancel message and trigger an authenticated file write in the victim's space (CSRF).

Related Issue

• Fixes OCISDEV-777

Motivation and Context

How Has This Been Tested?

• test environment: local oCIS, chrome browser
• test case 1: manual - reproduced the report's PoC from a foreign origin via window.open + postMessage(payload, '*'); no file is created and the modal stays open (before the fix a file was written)
• ...

Screenshots (if appropriate):

Open tasks:

• ...

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate failed

Failed conditions
7 Security Hotspots
48.2% Coverage on New Code (required ≥ 80%)
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE