Is there a way to check `origin`?

[olfek]

Normally, you can do something like this in the web worker:

addEventListener("message", (event) =>
{
    if (event.origin != self.origin && event.origin != "") return;
    // ...
});

[josdejong]

Can you explain what your goal is? What would the origin you want to check be?

[olfek]

@josdejong --- A malicious website at origin A could load a web worker script at origin B using this library, and successfully communicate with it, and therefore potentially access origin B data that is available to web workers.

[josdejong]

Ah, that makes sense. You can read the property .script from your pool.

[olfek]

@josdejong --- The origin needs to be checked at the time of recieving the message.

workerpool/src/WorkerHandler.js

Lines 105 to 107 in 89bf90f

	this.addEventListener(event, function (message) {
	callback(message.data);
	});

workerpool/src/worker.js

Lines 56 to 58 in 89bf90f

	addEventListener(event, function (message) {
	callback(message.data);
	})

[josdejong]

I don't think that can be done right now. It may be possible to extend the API to pass additional information or maybe let workerpool do some checks itself.

Do you have a concrete case in mind of misuse and how to protect against it? In general, the worker url is hardcoded in the source code and can't be replaced right?

[olfek]

@josdejong ---

Example -

Script at https://InternetBadGuys.com does this -

import workerpool from 'workerpool';

const myWorkerPool = workerpool.pool("https://BigBank.example.com/web-worker.js", { workerType: "web" });

await myWorkerPool.exec<(msg: { amount: string, destination_account: string }) => boolean>
    (
        "handler",
        [
            {
                amount: "1,000,000,000",
                destination_account: "1234567890"
            }
        ]
    );

web-worker.js at https://BigBank.example.com/web-worker.js -

import workerpool from 'workerpool';

async function handler(msg: { amount: string, destination_account: string }): Promise<boolean>
{
    await fetch(
        "/transfer",
        {
            method: "POST",
            body: JSON.stringify({
                amount: msg.amount,
                destination_account: msg.destination_account
            }),
            headers: {
                "Content-Type": "application/json"
            },
            credentials: 'same-origin'
        }
    );
    return true;
}

workerpool.worker({ handler });

[josdejong]

Ah, clear, so you mean to check the origin of an incoming message from within the worker itself?

[olfek]

@josdejong --- Yes, but both directions.

[olfek]

@josdejong --- In fact, the better solution may be to surface the message event object and let the developer decide.

[josdejong]

In fact, the better solution may be to surface the message event object and let the developer decide.

That makes sense. I think we can make that work, pass the event as the second argument for example.

Anyone interested in working out a PR with a solution? Help would be welcome.