CVE-2021-41038

An attacker can craft a malicious web page that opens or embeds a Theia webview and then sends a `postMessage()` call with a payload containing `command: 'onmessage'` or `command: 'do-update-state'`. Because the message handler did not verify the origin of the message, the webview would process the attacker-supplied data as if it came from a trusted child frame. This allows the attacker to inject arbitrary content into the webview, effectively hijacking its contents [CWE-940].

The vulnerability resides in `packages/plugin-ext/src/main/browser/webview/pre/host.js` in the `window.addEventListener('message', ...)` handler. The patch adds a check that verifies `e.source` is either a child frame, the window itself, or the parent window before processing the message. Without this check, any origin can send a `postMessage()` to the webview and have its `onmessage` or `do-update-state` commands accepted [patch_id=6635863].

The patch adds a loop that iterates over `window.frames` to check whether `e.source` is a child frame. It also allows messages from `window` itself and `window.parent`. If the source does not match any of these trusted origins, the handler returns early without processing the message. This ensures that only messages originating from the webview's own child frames, the webview window, or its parent are accepted, closing the spoofed-origin attack vector [patch_id=6635863].