VideoPress: Clean up postMessage bridge code by obenland · Pull Request #47436 · Automattic/jetpack

obenland · 2026-03-03T21:24:33Z

Fixes #

Proposed changes:

Replace targetOrigin: '*' with validated event.origin in token bridge JWT delivery
Add origin validation to player bridge listening path and block editor message listeners
Extract shared videopress-allowed-origins module with isAllowedOrigin() type guard
Remove dead legacy videopress-token-bridge.js and its webpack entry
Add comprehensive test suites for both token bridge (15 tests) and player bridge (7 tests)

Other information:

Security-adjacent cleanup of postMessage handlers. The token bridge was sending JWTs with targetOrigin: '*' — now uses the validated origin. Message listeners in the block editor hooks lacked origin checks (low risk since they're on SandBox contentWindow, but added for defense-in-depth).

No functional changes to the user-facing video player behavior.

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

N/A — security-adjacent cleanup, no product changes.

Does this pull request change what data or activity we track or use?

No. This PR does not change what data or activity we track or use. It only tightens origin validation on existing postMessage communication between the VideoPress player iframe and the host page.

Testing instructions:

Open the block editor with a VideoPress video block
Verify the video player loads and plays correctly
Enable debug logging: localStorage.debug = 'videopress:*' and reload
Confirm token bridge messages show the validated origin (not *)
Run cd projects/packages/videopress && pnpm test — all 139 tests pass

Changelog

Generate changelog entries for this PR (using AI).

Extract duplicated allowed-origins arrays into a shared module with a type guard, add debug logging to origin checks, and improve error handling in the token bridge and media token flows.

github-actions · 2026-03-03T21:25:21Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack), and enable the update/videopress-postmessage-cleanup branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack update/videopress-postmessage-cleanup

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2026-03-03T21:26:03Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Copilot

Pull request overview

Security-focused cleanup of VideoPress postMessage bridges to reduce cross-origin risk (notably avoiding targetOrigin: '*' when sending JWTs), centralize origin allowlisting, and add unit tests around the bridge behaviors.

Changes:

Introduce a shared videopress-allowed-origins module and apply origin validation across token/player bridges and block editor listeners.
Update the token bridge to reply using the validated event.origin (instead of *) and remove the legacy videopress-token-bridge.js + webpack entry.
Add new Jest test suites for token bridge and player bridge; improve token fetch failure logging in get-media-token.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
projects/packages/videopress/webpack.config.js	Removes the legacy token bridge webpack entry.
projects/packages/videopress/src/client/lib/videopress-token-bridge.js	Deletes unused legacy token bridge implementation.
projects/packages/videopress/src/client/lib/videopress-allowed-origins.ts	Adds shared allowlist + `isAllowedOrigin()` type guard.
projects/packages/videopress/src/client/lib/token-bridge/index.ts	Validates origin and uses validated `targetOrigin` for JWT delivery; adds try/catch around token fetch.
projects/packages/videopress/src/client/lib/token-bridge/test/index.test.ts	Adds coverage for origin validation and non-wildcard `targetOrigin` behavior.
projects/packages/videopress/src/client/lib/player-bridge/index.ts	Adds origin validation for listening events via shared allowlist.
projects/packages/videopress/src/client/lib/player-bridge/test/index.test.ts	Adds tests for listening/emitting behaviors and origin filtering.
projects/packages/videopress/src/client/lib/get-media-token/index.ts	Switches token request failure logging from `console.warn` to `debug`.
projects/packages/videopress/src/client/block-editor/hooks/use-video-player/index.ts	Adds origin validation to message listener in the editor hook.
projects/packages/videopress/src/client/block-editor/blocks/video/components/poster-panel/index.tsx	Makes `postMessage` target origin explicit (`'*'`).
projects/packages/videopress/src/client/block-editor/blocks/video/components/player/index.tsx	Adds origin validation for the player loading-state listener.
projects/packages/videopress/changelog/harden-videopress-postmessage-security	Adds a patch changelog entry describing the hardening.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

projects/packages/videopress/src/client/block-editor/hooks/use-video-player/index.ts

projects/packages/videopress/src/client/lib/player-bridge/index.ts

projects/packages/videopress/src/client/lib/token-bridge/index.ts

jp-launch-control · 2026-03-03T21:41:00Z

Code Coverage Summary

Coverage changed in 4 files.

File	Coverage	Δ%	Δ Uncovered
projects/packages/videopress/src/client/block-editor/hooks/use-video-player/index.ts	31/77 (40.26%)	-2.80%	5 💔
projects/packages/videopress/src/client/block-editor/blocks/video/components/player/index.tsx	43/77 (55.84%)	-1.49%	2 ❤️‍🩹
projects/packages/videopress/src/client/lib/player-bridge/index.ts	18/18 (100.00%)	100.00%	-19 💚
projects/packages/videopress/src/client/lib/token-bridge/index.ts	45/51 (88.24%)	88.24%	-44 💚

1 file is newly checked for coverage.

File	Coverage
projects/packages/videopress/src/client/lib/videopress-allowed-origins.ts	2/2 (100.00%) 💚

Full summary · PHP report · JS report

_{If appropriate, add one of these labels to override the failing coverage check:

Covered by non-unit tests
Use to ignore the Code coverage requirement check when E2Es or other non-unit tests cover the code

Coverage tests to be added later
Use to ignore the Code coverage requirement check when tests will be added in a follow-up PR

I don't care about code coverage for this PR
Use this label to ignore the check for insufficient code coveage.}

Browsers can deliver MessageEvents with null source (e.g., from closed windows or certain cross-origin scenarios). Add a null check alongside the existing MessagePort/ServiceWorker guards to prevent a TypeError when calling postMessage on a null source. Also strengthens the 'accepts messages from video.wordpress.com' test to verify call count and payload content instead of just toHaveBeenCalled.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

projects/packages/videopress/src/client/lib/token-bridge/index.ts

Move the origin and source checks above getSubscriberPlanIdIfExists() so invalid messages are rejected immediately without awaiting async I/O.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

obenland added 2 commits March 3, 2026 15:15

VideoPress: Clean up postMessage bridge code and add tests

f8cd750

VideoPress: Extract shared origins module and improve error handling

161f5a1

Extract duplicated allowed-origins arrays into a shared module with a type guard, add debug logging to origin checks, and improve error handling in the token bridge and media token flows.

Copilot AI review requested due to automatic review settings March 3, 2026 21:24

obenland added the [Status] Needs Review This PR is ready for review. label Mar 3, 2026

Copilot started reviewing on behalf of obenland March 3, 2026 21:25 View session

github-actions bot added [Package] VideoPress [Tests] Includes Tests labels Mar 3, 2026

github-actions bot added [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. and removed [Status] Needs Review This PR is ready for review. labels Mar 3, 2026

Copilot AI reviewed Mar 3, 2026

View reviewed changes

obenland added [Status] Needs Review This PR is ready for review. and removed [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. labels Mar 4, 2026

obenland added 2 commits March 4, 2026 15:26

VideoPress: Add null guard for event.source in use-video-player hook

3be139b

Copilot AI review requested due to automatic review settings March 4, 2026 21:40

Copilot started reviewing on behalf of obenland March 4, 2026 21:40 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

projects/packages/videopress/src/client/lib/token-bridge/index.ts Outdated Show resolved Hide resolved

VideoPress: Validate origin and source before async work in token bridge

52fa4c3

Move the origin and source checks above getSubscriberPlanIdIfExists() so invalid messages are rejected immediately without awaiting async I/O.

obenland requested a review from Copilot March 5, 2026 14:07

Copilot started reviewing on behalf of obenland March 5, 2026 14:07 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

VideoPress: Clean up postMessage bridge code#47436

VideoPress: Clean up postMessage bridge code#47436
obenland wants to merge 5 commits intotrunkfrom
update/videopress-postmessage-cleanup

obenland commented Mar 3, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jp-launch-control bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

obenland commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes:

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Changelog

Uh oh!

github-actions bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jp-launch-control bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

obenland commented Mar 3, 2026 •

edited

Loading

github-actions bot commented Mar 3, 2026 •

edited

Loading

github-actions bot commented Mar 3, 2026 •

edited

Loading

jp-launch-control bot commented Mar 3, 2026 •

edited

Loading