Vulnerable S3

Trusted partner — regex origin check

The portal validates the sender with a regular expression instead of comparing the origin to a fixed string.

window.addEventListener("message", function(event) {
  const trustedOriginPattern = /^https:\/\/.*\.trusted-origin\.com$/;
  if (!trustedOriginPattern.test(event.origin)) {
    return;
  }
  document.getElementById("output").innerHTML = event.data;
});

const trustedOriginPattern = /^https?:\/\/.*\.trusted-origin\.pmlab\.amir\.baby(:\d+)?$/;
if (!trustedOriginPattern.test(event.origin)) {
  return;
}
document.getElementById("output").innerHTML = event.data;

The bug is the .*. It happily swallows any number of extra labels, so https://attacker.com.trusted-origin.com matches a pattern that was meant to allow only <label>.trusted-origin.com.
Two differences from the writeup's literal are incidental to the bug: the scheme is https? (the lab runs on http) and the port group (:\d+)? exists because the lab serves on port 443.
Bonus: the pattern also rejects the bare base domain https://trusted-origin.pmlab.amir.baby — .* must be followed by a literal dot.

Attacker page →

Widget output

Raw payload received

—

Embedded partner widget

Served from https://vendor.trusted-origin.pmlab.amir.baby — matches the pattern.

Trusted partner — regex origin check

Widget output

Raw payload received

Embedded partner widget

Message flow