Explicitly tag PyDis messages for integrity

python-discord · Jul 3, 2024 · 7f8b0b0 · 7f8b0b0
1 parent 37f3b5c
commit 7f8b0b0
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/src/api/auth.ts b/src/api/auth.ts
@@ -125,6 +125,11 @@ export async function getDiscordCode(scopes: OAuthScopes[], disableFunction?: (d
                 return;
             }
 
+            if (message.data.pydis_source !== "oauth2_callback") {
+                // Ignore messages not from the callback
+                return;
+            }
+
             if (message.isTrusted) {
                 windowRef?.close();
 

diff --git a/src/pages/CallbackPage.tsx b/src/pages/CallbackPage.tsx
@@ -11,7 +11,7 @@ export default function CallbackPage(): JSX.Element {
 
     if (!hasSent) {
         setHasSent(true);
-        window.opener.postMessage({code: code, state: state});
+        window.opener.postMessage({code: code, state: state, pydis_source: "oauth2_callback"});
     }
 
     return <div/>;