From ae7838c01b0af08c3e205e1c63200ca4c1ffa13e Mon Sep 17 00:00:00 2001
From: Henri Bergius <henri.bergius@iki.fi>
Date: Thu, 22 Mar 2018 21:59:27 +0100
Subject: [PATCH] Filter out messages coming from other sources than the
 runtime

---
 src/lib/iframe.coffee | 3 +++
 src/lib/opener.coffee | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/src/lib/iframe.coffee b/src/lib/iframe.coffee
index d14199a..a9476f0 100644
--- a/src/lib/iframe.coffee
+++ b/src/lib/iframe.coffee
@@ -130,6 +130,9 @@ class IframeRuntime extends Base
     ), w.location.href
 
   onMessage: (message) =>
+    if message.source and message.source isnt @iframe.contentWindow
+      # Message from unrelated source
+      return
     if typeof message.data is 'string'
       data = JSON.parse message.data
     else
diff --git a/src/lib/opener.coffee b/src/lib/opener.coffee
index d353506..2c18c9a 100644
--- a/src/lib/opener.coffee
+++ b/src/lib/opener.coffee
@@ -83,6 +83,9 @@ class OpenerRuntime extends Base
     ), '*'
 
   onMessage: (message) =>
+    if message.source and message.source isnt @iframe.contentWindow
+      # Message from unrelated source
+      return
     if typeof message.data is 'string'
       data = JSON.parse message.data
     else