fix(embedded): enforce configured allowed domains for postMessage origin (#40629)

Co-authored-by: Claude Code <noreply@anthropic.com>

tests/integration_tests/embedded/test_view.py

@@ -16,6 +16,8 @@
 # under the License.
 from __future__ import annotations
 
+import html
+import re
 from typing import TYPE_CHECKING
 from unittest import mock
 
@@ -24,6 +26,7 @@ import pytest
 from superset import db
 from superset.daos.dashboard import EmbeddedDashboardDAO
 from superset.models.dashboard import Dashboard
+from superset.utils import json
 from tests.integration_tests.fixtures.birth_names_dashboard import (
     load_birth_names_dashboard_with_slices,  # noqa: F401
     load_birth_names_data,  # noqa: F401
@@ -36,6 +39,14 @@ if TYPE_CHECKING:
     from flask.testing import FlaskClient
 
 
+def _extract_bootstrap_data(response_data: bytes) -> dict[str, Any]:
+    """Parse the JSON bootstrap payload embedded in the SPA template."""
+    html_body = response_data.decode("utf-8")
+    match = re.search(r'data-bootstrap="([^"]*)"', html_body)
+    assert match is not None, "bootstrap payload not found in response"
+    return json.loads(html.unescape(match.group(1)))
+
+
 @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
 @mock.patch.dict(
     "superset.extensions.feature_flag_manager._feature_flags",
@@ -48,6 +59,28 @@ def test_get_embedded_dashboard(client: FlaskClient[Any]):  # noqa: F811
     uri = f"embedded/{embedded.uuid}"
     response = client.get(uri)
     assert response.status_code == 200
+    # The bootstrap payload exposes the (empty) allowed-domains list so the
+    # frontend can validate postMessage origins.
+    bootstrap = _extract_bootstrap_data(response.data)
+    assert bootstrap["embedded"]["allowed_domains"] == []
+
+
+@pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
+@mock.patch.dict(
+    "superset.extensions.feature_flag_manager._feature_flags",
+    EMBEDDED_SUPERSET=True,
+)
+def test_get_embedded_dashboard_bootstrap_includes_allowed_domains(
+    client: FlaskClient[Any],  # noqa: F811
+):
+    dash = db.session.query(Dashboard).filter_by(slug="births").first()
+    embedded = EmbeddedDashboardDAO.upsert(dash, ["https://allowed.example.com"])
+    db.session.flush()
+    uri = f"embedded/{embedded.uuid}"
+    response = client.get(uri, headers={"Referer": "https://allowed.example.com"})
+    assert response.status_code == 200
+    bootstrap = _extract_bootstrap_data(response.data)
+    assert bootstrap["embedded"]["allowed_domains"] == ["https://allowed.example.com"]
 
 
 @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")