Power Platform Community Forum Thread Details

Hello,

We had a previous issue with the PowerApp SDK on this thread postMessage with star origin issue - Power Platform Community (microsoft.com).

We are using the PowerApp SDK from https://apps.powerapps.com/apphost/clientsdk?version=1

We received a complain about a vulnerability regarding two PostMessage API `message` event listeners that are registered. Both event listeners validate the origin of received messages using a whitelist and a RegEx as a fallback.

The validation RegEx will accept any URL that begins with `https://app.powerapps.com` does not do sufficient checks to ensure its not exploited for unauthorized usage.

Is there a team or a point of contact we can contact about the PowerApp SDK? Is there any updated version provided in an npm package or similar that we can use?

Thanks

Guilherme

Categories:

Power Apps Pro Dev & ISV