dynamic iframe url about penpal HOT 3 CLOSED

@Aaronius Please check PR #74 :)

from penpal.

Thanks for the contribution, @KutnerUri! I see your predicament and why you would want this feature. I want to make sure the security implications of not using https://symphony.bit.dev for childOrigin are considered. In this case, if an attacker were to be able to nefariously navigate the iframe to a nefarious URL, the page at the nefarious URL could spoof being a legitimate child and receive potentially sensitive information from your parent.

For example, if, inside your https://symphony.bit.dev/api/resolve/teambit.organization page, a nefarious attacker could make a link appear that others could click on (for example, if you failed to inadequately escape HTML in a message board comment), and that link navigates an unsuspecting user's iframe to a nefarious page, then the nefarious page could communicate with your parent window and start receiving communication.

Does that make sense? Would you be willing to accept that risk?

from penpal.

Considering your comments that followed on the pull request, I think you're willing to accept the risk in your case.

Thanks for your contribution, @KutnerUri! Released as v6.2.0.

from penpal.