Merge pull request #2410 from getAlby/fix/limit-postmessage-to-origin

fix: add window.location.origin to postMessage

src/extension/content-script/onendalby.js

@@ -97,7 +97,7 @@ function postMessage(ev, response) {
       data: response,
       scope: "alby",
     },
-    "*"
+    window.location.origin
   );
 }
 

src/extension/content-script/onendnostr.js

@@ -119,7 +119,7 @@ function postMessage(ev, response) {
       data: response,
       scope: "nostr",
     },
-    "*"
+    window.location.origin
   );
 }
 

src/extension/content-script/onendwebbtc.js

@@ -107,7 +107,7 @@ function postMessage(ev, response) {
       data: response,
       scope: SCOPE,
     },
-    "*"
+    window.location.origin
   );
 }
 

src/extension/content-script/onendwebln.js

@@ -126,7 +126,7 @@ function postMessage(ev, response) {
       data: response,
       scope: "webln",
     },
-    "*"
+    window.location.origin
   );
 }
 

src/extension/providers/postMessage.ts

@@ -17,7 +17,7 @@ export function postMessage<T>(
         scope: scope,
         args,
       },
-      "*" // TODO use origin
+      window.location.origin
     );
 
     function handleWindowMessage(messageEvent: MessageEvent) {