fix: DATA-11516 Add targetOrigin for postMessage calls

[bc-rmalyavc]

What?

Per title

Why?

Currently we are passing a wildcard (*) as a target when calling the window.postMessage method. This allows attackers to intercept the messages. So that we need to specify target which should be current store's CP url.

Testing / Proof

Manually tested on prod store. Verified both dev and prod environments. Verified that the messages e.g. Cancel or Use this button click are only intercepted when the store URL is correct. F.e. on prod store when the app is running in dev mode, the buttons won't do anything.

@bigcommerce/team-data

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
ai-app-foundation	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 9, 2024 4:59pm

[bc-prestonhuth]

This is a good PR to get feedback from @bigcommerce/frontend on since they've had to address this issue elsewhere before. I know @rtalvarez had to for instance back on Channels team. My main concern is whether we are considering all of the necessary scenarios in terms of what the CP URL could be.

PR description is very helpful btw @bc-rmalyavc. Thanks for all of the good info.

[bc-rmalyavc]

Hey @bc-prestonhuth,
Thanks for your feedback.
As far as I know, this kind of apps can be only installed on production stores. So that there may be only one possible CP url. Otherwise we would need to cover URLs like my-integration.zone or .my-staging.zone. On the second thought there seemed to be no need to cover development environment either.
I'd appreciate any feedback from @bigcommerce/frontend, though in case I'm missing something here.