From bf3a2b768e6404adcc996685b4fb139e4ebe45b0 Mon Sep 17 00:00:00 2001
From: Elian Doran <contact@eliandoran.me>
Date: Wed, 31 Dec 2025 16:37:51 +0200
Subject: [PATCH] chore(pdfjs): set proper target origin when posting messages

---
 apps/client/src/widgets/type_widgets/file/Pdf.tsx | 10 +++++-----
 packages/pdfjs-viewer/src/attachments.ts          |  6 +++---
 packages/pdfjs-viewer/src/layers.ts               |  8 ++++----
 packages/pdfjs-viewer/src/pages.ts                |  6 +++---
 packages/pdfjs-viewer/src/toc.ts                  |  8 ++++----
 5 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/apps/client/src/widgets/type_widgets/file/Pdf.tsx b/apps/client/src/widgets/type_widgets/file/Pdf.tsx
index e46d64717..c915a0a5d 100644
--- a/apps/client/src/widgets/type_widgets/file/Pdf.tsx
+++ b/apps/client/src/widgets/type_widgets/file/Pdf.tsx
@@ -50,7 +50,7 @@ export default function PdfPreview({ note, blob, componentId, noteContext }: {
                             iframeRef.current?.contentWindow?.postMessage({
                                 type: "trilium-scroll-to-heading",
                                 headingId: heading.id
-                            }, "*");
+                            }, window.location.origin);
                         }
                     });
                 } else {
@@ -81,13 +81,13 @@ export default function PdfPreview({ note, blob, componentId, noteContext }: {
                         iframeRef.current?.contentWindow?.postMessage({
                             type: "trilium-scroll-to-page",
                             pageNumber: page
-                        }, "*");
+                        }, window.location.origin);
                     },
                     requestThumbnail: (page: number) => {
                         iframeRef.current?.contentWindow?.postMessage({
                             type: "trilium-request-thumbnail",
                             pageNumber: page
-                        }, "*");
+                        }, window.location.origin);
                     }
                 });
             }
@@ -119,7 +119,7 @@ export default function PdfPreview({ note, blob, componentId, noteContext }: {
                         iframeRef.current?.contentWindow?.postMessage({
                             type: "trilium-download-attachment",
                             filename
-                        }, "*");
+                        }, window.location.origin);
                     }
                 });
             }
@@ -132,7 +132,7 @@ export default function PdfPreview({ note, blob, componentId, noteContext }: {
                             type: "trilium-toggle-layer",
                             layerId,
                             visible
-                        }, "*");
+                        }, window.location.origin);
                     }
                 });
             }
diff --git a/packages/pdfjs-viewer/src/attachments.ts b/packages/pdfjs-viewer/src/attachments.ts
index fefe554ee..3016ec8e1 100644
--- a/packages/pdfjs-viewer/src/attachments.ts
+++ b/packages/pdfjs-viewer/src/attachments.ts
@@ -24,7 +24,7 @@ async function extractAndSendAttachments() {
             window.parent.postMessage({
                 type: "pdfjs-viewer-attachments",
                 attachments: []
-            }, "*");
+            }, window.location.origin);
             return;
         }
 
@@ -42,13 +42,13 @@ async function extractAndSendAttachments() {
                 filename: att.filename,
                 size: att.size
             }))
-        }, "*");
+        }, window.location.origin);
     } catch (error) {
         console.error("Error extracting attachments:", error);
         window.parent.postMessage({
             type: "pdfjs-viewer-attachments",
             attachments: []
-        }, "*");
+        }, window.location.origin);
     }
 }
 
diff --git a/packages/pdfjs-viewer/src/layers.ts b/packages/pdfjs-viewer/src/layers.ts
index 010c4e766..bb4b12a5a 100644
--- a/packages/pdfjs-viewer/src/layers.ts
+++ b/packages/pdfjs-viewer/src/layers.ts
@@ -28,7 +28,7 @@ async function extractAndSendLayers() {
             window.parent.postMessage({
                 type: "pdfjs-viewer-layers",
                 layers: []
-            }, "*");
+            }, window.location.origin);
             return;
         }
 
@@ -38,7 +38,7 @@ async function extractAndSendLayers() {
             window.parent.postMessage({
                 type: "pdfjs-viewer-layers",
                 layers: []
-            }, "*");
+            }, window.location.origin);
             return;
         }
 
@@ -77,13 +77,13 @@ async function extractAndSendLayers() {
         window.parent.postMessage({
             type: "pdfjs-viewer-layers",
             layers
-        }, "*");
+        }, window.location.origin);
     } catch (error) {
         console.error("Error extracting layers:", error);
         window.parent.postMessage({
             type: "pdfjs-viewer-layers",
             layers: []
-        }, "*");
+        }, window.location.origin);
     }
 }
 
diff --git a/packages/pdfjs-viewer/src/pages.ts b/packages/pdfjs-viewer/src/pages.ts
index 5cb74811a..e63c234b9 100644
--- a/packages/pdfjs-viewer/src/pages.ts
+++ b/packages/pdfjs-viewer/src/pages.ts
@@ -16,7 +16,7 @@ export function setupPdfPages() {
         window.parent.postMessage({
             type: "pdfjs-viewer-current-page",
             currentPage: evt.pageNumber
-        }, "*");
+        }, window.location.origin);
     });
 
     // Listen for scroll-to-page requests
@@ -43,7 +43,7 @@ function sendPageInfo() {
         type: "pdfjs-viewer-page-info",
         totalPages: app.pdfDocument.numPages,
         currentPage: app.pdfViewer.currentPageNumber
-    }, "*");
+    }, window.location.origin);
 }
 
 async function generateThumbnail(pageNumber: number) {
@@ -76,7 +76,7 @@ async function generateThumbnail(pageNumber: number) {
             type: "pdfjs-viewer-thumbnail",
             pageNumber,
             dataUrl
-        }, "*");
+        }, window.location.origin);
     } catch (error) {
         console.error(`Error generating thumbnail for page ${pageNumber}:`, error);
     }
diff --git a/packages/pdfjs-viewer/src/toc.ts b/packages/pdfjs-viewer/src/toc.ts
index a1e7b34d2..eca3d7da8 100644
--- a/packages/pdfjs-viewer/src/toc.ts
+++ b/packages/pdfjs-viewer/src/toc.ts
@@ -11,7 +11,7 @@ export async function extractAndSendToc() {
             window.parent.postMessage({
                 type: "pdfjs-viewer-toc",
                 data: null
-            }, "*");
+            }, window.location.origin);
             return;
         }
 
@@ -26,12 +26,12 @@ export async function extractAndSendToc() {
         window.parent.postMessage({
             type: "pdfjs-viewer-toc",
             data: toc
-        }, "*");
+        }, window.location.origin);
     } catch (error) {
         window.parent.postMessage({
             type: "pdfjs-viewer-toc",
             data: null
-        }, "*");
+        }, window.location.origin);
     }
 }
 
@@ -163,7 +163,7 @@ export function setupActiveHeadingTracking() {
             window.parent.postMessage({
                 type: "pdfjs-viewer-active-heading",
                 headingId: activeHeadingId
-            }, "*");
+            }, window.location.origin);
         }
     }