From e96b704def71d8419beb4085f88c99b50350d5c7 Mon Sep 17 00:00:00 2001
From: Rohan Sharma <i.am.lone.survivor@protonmail.com>
Date: Tue, 1 Feb 2022 22:04:48 +0530
Subject: [PATCH] Fixed prototype pollution bug and only allow trusted origin
 (#17420)

---
 public/embed.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/embed.js b/public/embed.js
index dac5074537..d597fd33c7 100644
--- a/public/embed.js
+++ b/public/embed.js
@@ -15,7 +15,7 @@
     window.addEventListener('message', function(e) {
       var data = e.data || {};
 
-      if (data.type !== 'setHeight' || !iframes[data.id]) {
+      if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
         return;
       }