diff options
| -rw-r--r-- | public/embed.js | 36 |
1 files changed, 29 insertions, 7 deletions
diff --git a/public/embed.js b/public/embed.js index d597fd33c..5607c24d5 100644 --- a/public/embed.js +++ b/public/embed.js @@ -1,6 +1,11 @@ +// @ts-check + (function() { 'use strict'; + /** + * @param {() => void} loaded + */ var ready = function(loaded) { if (['interactive', 'complete'].indexOf(document.readyState) !== -1) { loaded(); @@ -10,25 +15,42 @@ }; ready(function() { - var iframes = []; + /** @type {Map<number, HTMLIFrameElement>} */ + var iframes = new Map(); window.addEventListener('message', function(e) { var data = e.data || {}; - if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') { + if (typeof data !== 'object' || data.type !== 'setHeight' || !iframes.has(data.id)) { + return; + } + + var iframe = iframes.get(data.id); + + if ('source' in e && iframe.contentWindow !== e.source) { return; } - iframes[data.id].height = data.height; + iframe.height = data.height; }); [].forEach.call(document.querySelectorAll('iframe.mastodon-embed'), function(iframe) { - iframe.scrolling = 'no'; - iframe.style.overflow = 'hidden'; + // select unique id for each iframe + var id = 0, failCount = 0, idBuffer = new Uint32Array(1); + while (id === 0 || iframes.has(id)) { + id = crypto.getRandomValues(idBuffer)[0]; + failCount++; + if (failCount > 100) { + // give up and assign (easily guessable) unique number if getRandomValues is broken or no luck + id = -(iframes.size + 1); + break; + } + } - iframes.push(iframe); + iframes.set(id, iframe); - var id = iframes.length - 1; + iframe.scrolling = 'no'; + iframe.style.overflow = 'hidden'; iframe.onload = function() { iframe.contentWindow.postMessage({ |