use postMessage instead of window object

hosting/couchdb/sqs/install.sh

@@ -1,5 +1,4 @@
 #!/bin/bash
-
 SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )"
 if [[ $TARGETARCH == arm* ]] ;
 then

packages/builder/src/dataBinding.js

@@ -825,11 +825,11 @@ const getEmbedBindings = () => {
   bindings = [
     {
       type: "context",
-      runtimeBinding: `${safeEmbed}.`,
+      runtimeBinding: `${safeEmbed}`,
-      readableBinding: `ParentData`,
+      readableBinding: `ParentWindow`,
       category: "Embed",
-      icon: "DevicePhone",
+      icon: "DistributeVertically",
-      display: { type: "object", name: "Parent Data" },
+      display: { type: "object", name: "Parent Window" },
     },
   ]
   return bindings

packages/client/src/components/context/EmbedProvider.svelte

@@ -1,11 +1,41 @@
 <script>
   import Provider from "./Provider.svelte"
+  import { onMount } from "svelte"
+
+  let data = {}
+
+  export function extractDomainFromUrl(url) {
+    const { hostname } = new URL(url)
+    const parts = hostname.split('.');
+    const tld = parts.slice(-2).join(".")
+    return tld
+  }
+
+  export function handleMessage(event) {
+    // Validate the event origin to ensure it's coming from a trusted source
+    // Allow different subdomains but must match TLD
+    const appOrigin = extractDomainFromUrl(window.location.origin)
+    const eventOrigin = extractDomainFromUrl(event.origin)
+
+    if (appOrigin !== eventOrigin) {
+      data = event.data
+    } else {
+      console.error(
+        `Embedded budibase app domain ${appOrigin} does not match origin of event ${eventOrigin}.
+        Top level domains must match`
+      )
+    }
+  }
+
+  onMount(() => {
+    window.addEventListener("message", handleMessage)
+
+    return () => window.removeEventListener("message", handleMessage)
+  })
 
-  $: data = window.parent?.data
-  $: console.log("parentWindow", data)
 </script>
 
 
 <Provider key="embed" {data}>
   <slot />
-</Provider>
+</Provider>

packages/pro

@@ -1 +1 @@
-Subproject commit 7dbe323aec724ae6336b13c06aaefa4a89837edf
+Subproject commit 14c89a5b20ee4de07723063458a2437b0dd4f2c9