[SEC-W-06] Service-worker postMessage payload accepted without kind / origin check #244

Commit: 2f26d91 · Finding: SEC-W-06

Problem

crates/web/src/main.rs:47-62 installs a navigator.serviceWorker.onmessage handler that blindly trusts ev.data, stashes it on window.__willowLastPush, and dispatches a willow-push Event. No ev.origin / ev.source / kind discriminator check. The reader at crates/web/src/app.rs:266-307 does type-check via Reflect::get, but window.__willowLastPush is a globally-readable side-effect any same-origin script (including dev tooling, browser extensions, future injected scripts) can read.

Since this is serviceWorker.message (only same-origin SW can emit), the risk is lower than window.onmessage, but the pattern is dangerous — any future copy-paste into a window-message handler inherits "trust everything".

Fix

• Verify ev.data?.kind === 'willow-push' (or willow-notification-click) before accepting.
• Pass the payload via a module-local RefCell / channel instead of window.__willowLastPush.

Obvious fix — will be auto-PR'd.