Strict S2a

Trusted partner — exact origin match

The portal only accepts messages from its one partner, https://trusted-domain.pmlab.amir.baby. This is the code exactly as printed in the writeup.

window.addEventListener("message", function(event) {
  if (event.origin !== "https://trusted-domain.com") {
    console.log("Invalid origin!");
    return;
  }
  document.getElementById("output").innerHTML = event.data;
});

As written, this check holds. The writeup's note says the attacker's origin https://attacker.trusted-domain.com “would be accepted by any postMessage validation that only checks for the base domain” — that describes a different validator, not this one. Here the comparison is exact (!==), so a subdomain does not match and the message is dropped. The subdomain attack lands on /s2-base, which implements the base-domain check the note is talking about.

Compare: /s2-base (weak) → Attacker page →

Widget output

Raw payload received

—

Embedded partner widget

Served from https://trusted-domain.pmlab.amir.baby — the only origin this page trusts.

Trusted partner — exact origin match

Widget output

Raw payload received

Embedded partner widget

Message flow