Vulnerable S3

Trusted partner — regex origin check

The portal validates the sender with a regular expression instead of comparing the origin to a fixed string.

const trustedOriginPattern = /^https?:\/\/.*\.trusted-origin\.pmlab\.amir\.baby(:\d+)?$/;
window.addEventListener("message", function(event) {
  if (!trustedOriginPattern.test(event.origin)) {
    return;
  }
  document.getElementById("output").innerHTML = event.data;
});

The bug is the .*. It happily swallows any number of extra labels, so https://attacker.com.trusted-origin.com matches a pattern that was meant to allow only <label>.trusted-origin.com.
Two differences from the writeup's literal are incidental to the bug: the scheme is https? (the lab runs over https) and the port group (:\d+)? exists because the lab serves on port 443.
Bonus: the pattern also rejects the bare base domain https://trusted-origin.pmlab.amir.baby — .* must be followed by a literal dot.

Drive it from the attacker origin →

Widget output

Embedded partner widget

Served from https://vendor.trusted-origin.pmlab.amir.baby — matches the pattern.