morethanwords/tweb/master • 3501e76 • 11 files, +107/-23 Take a frame's url and height as input rath

morethanwords/tweb/master • 3501e76 • 11 files, +107/-23
Take a frame's url and height as input rather than at face value

Three values a hosted frame — a mini app, a payment provider, an Instant View
embed — hands the client were used as given.

`path_full` from a `web_app_open_tg_link` event was pasted onto the bare host,
so a value that does not open with a slash landed in the host instead of the
path: '.evil.com/x' built https://t.me.evil.com/x. It walks out of the
registrable domain but not out of the client, because wrapUrl's t.me regexp is
not anchored at its end and matches the result anyway, handing it to the `im`
handler, which reads the parsed path and never the href — so the link opens a
username. Both call sites build it through `getWebViewTgLink` now, which anchors
the path.

`resize_frame` from an Instant View embed set the block height with no ceiling.
The event is the embed's own way of asking for the room its content needs, and
the document that sends it is third party by definition — after a navigation
away, not even the one the block asked for — so the height is capped at four
viewports.

`keyboardButtonUrlAuth.url` reached `window.open()` raw, the one url in the
client that skipped `safeWindowOpen`; the server rejects a non-https button url
today, which is what kept it out of reach. Its local `openWindow` wrapper is
gone. The helper it now shares, meanwhile, repeated wrapUrl's protocol filter
for none of its callers, and most of them pass a url straight off the wire — a
web app event, a gift's listing url, a bot's privacy policy. The filter lives in
`normalizeUrlProtocol` and runs there too, replacing the three hand-rolled
copies of it.

Untouched: the bridge still authorizes an inbound message by WindowProxy
identity alone unless the server asked for `same_origin`, and still answers a
frame it is not bound to at '*'. Binding it by default would break the
cross-origin hops the opt-in exists to permit — a 3DS redirect, an OAuth leg.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

#webk