NestedCORSiFramePOC/client.html at master · ShapeOfMatter/NestedCORSiFramePOC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<!DOCTYPE html>
<html>
  <head>
    <title>The stupidest client.</title>
    <meta charset="UTF-8">
    <script type="text/javascript">
      const pipe = new MessageChannel();
      const work = (request)=>{
          return "555";
      };
      pipe.port1.onmessage = (e)=>{
          const newPort = e.data.port;
          const request = e.data.resource;
          const response = work(request);
          console.log(`Receipt requested for [${request.method}]${request.url}; returning "${response}"`);
          newPort.postMessage(response);
          newPort.close();
      };
      window.parent.postMessage(pipe.port2, '*', [pipe.port2]); //should I be more restrictive of the recipient?
    </script>
  </head>
  <body</body>
</html>