whitelist

Author: turtledreams

CHANGELOG.md

@@ -1,3 +1,7 @@
+## X.X.X
+
+* added content whitelist
+
 ## 25.1.0
 
 * Mitigated an issue where content resizing did not work in certain orientations.

modules/CountlyClass.js

@@ -214,6 +214,7 @@ class CountlyClass {
         this.maxStackTraceLinesPerThread = getConfig("max_stack_trace_lines_per_thread", ob, configurationDefaultValues.MAX_STACKTRACE_LINES_PER_THREAD);
         this.maxStackTraceLineLength = getConfig("max_stack_trace_line_length", ob, configurationDefaultValues.MAX_STACKTRACE_LINE_LENGTH);
         this.heatmapWhitelist = getConfig("heatmap_whitelist", ob, []);
+        this.contentWhitelist = getConfig("content_whitelist", ob, []);
         this.salt = getConfig("salt", ob, null);
         this.hcErrorCount = this.#getValueFromStorage(healthCheckCounterEnum.errorCount) || 0;
         this.hcWarningCount = this.#getValueFromStorage(healthCheckCounterEnum.warningCount) || 0;
@@ -276,6 +277,14 @@ class CountlyClass {
             }
         }
 
+        if (Array.isArray(this.contentWhitelist)) {
+            this.contentWhitelist.push(this.url);
+            this.contentWhitelist = this.contentWhitelist.map((e) => {
+                // remove trailing slashes from the entries
+                return stripTrailingSlash(e);
+            });
+        }
+
         if ((this.passed_data && this.passed_data.app_key && this.passed_data.app_key === this.app_key) || (this.passed_data && !this.passed_data.app_key && this.#global)) {
             if (this.passed_data.token && this.passed_data.purpose) {
                 if (this.passed_data.token !== this.#getValueFromStorage("cly_old_token")) {
@@ -3825,7 +3834,7 @@ class CountlyClass {
     };
 
     #interpretContentMessage = (messageEvent) => {
-        if (messageEvent.origin !== this.url) {
+        if (this.contentWhitelist.indexOf(messageEvent.origin) === -1) {
             // this.#log(logLevelEnums.ERROR, "interpretContentMessage, Received message from invalid origin");
             // silent ignore
             return;