* only begin iframe reheight once document state is complete
* format
* lint fixes
* Update public/embed.js to use readystatechange event listener
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
* Call loaded() if ready, otherwise add listenter
* lint fix
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
also including some refactoring:
- add `// @ts-check`
- use Map to completely avoid prototype pollution
- assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts
- check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec)
follow-up of #17420fix#18299
Matt Hodges
rinsuki
Rohan Sharma
Eugen Rochko