Security Weakness: Origin validation using in function #18

File: /app/app/javascript/widget/utils.ts
Function: isValidHost

Issue: The isValidHost function uses url.host.endsWith(ROOT_DOMAIN) and url.host.endsWith(customDomain) to validate the origin of postMessages. This method is potentially insecure because it can be bypassed if an attacker registers a domain that ends with the expected ROOT_DOMAIN or customDomain (e.g., attacker.com.trusted.com would pass if trusted.com is the domain).

Impact: Currently, the message handlers using isValidHost (in embed.ts and overlay.ts) only pass data to safe sinks (style.height, ariaLabel), so there is no immediate XSS vulnerability. However, this weak validation poses a future risk. If new message handlers are added or existing ones are modified to use message data in dangerous sinks (like innerHTML, eval, location.href, etc.), this vulnerability could become exploitable.

Recommendation: Refactor isValidHost to perform stricter origin validation. Options include:

1. Exact matching against a list of known, trusted origins.
2. Using a more robust library or method for suffix checking that accounts for domain boundaries (e.g., ensuring the character before the suffix is a dot .)
3. Comparing against process.env.ROOT_DOMAIN, process.env.SHORT_DOMAIN, and customDomain using exact equality checks (===) if subdomains are not expected or required for messaging.

Addressing this proactively will prevent potential future XSS vulnerabilities.