From b8dd081d8ab33631c67526e2f168f60f9bf4a9ae Mon Sep 17 00:00:00 2001
From: Esteban Beltran <academo@users.noreply.github.com>
Date: Fri, 1 Sep 2023 15:54:06 +0200
Subject: [PATCH] Sandbox: Fix post message trying to serialize proxy objects
 inside plugins (#73596)

---
 .../plugins/sandbox/distortion_map.ts         | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/public/app/features/plugins/sandbox/distortion_map.ts b/public/app/features/plugins/sandbox/distortion_map.ts
index ad8d2bacfc4..d74a85ab86e 100644
--- a/public/app/features/plugins/sandbox/distortion_map.ts
+++ b/public/app/features/plugins/sandbox/distortion_map.ts
@@ -83,6 +83,7 @@ export function getGeneralSandboxDistortionMap() {
     distortWorkers(generalDistortionMap);
     distortDocument(generalDistortionMap);
     distortMonacoEditor(generalDistortionMap);
+    distortPostMessage(generalDistortionMap);
   }
   return generalDistortionMap;
 }
@@ -494,6 +495,30 @@ async function distortMonacoEditor(distortions: DistortionMap) {
   Reflect.set(monacoEditor, SANDBOX_LIVE_API_PATCHED, {});
 }
 
+async function distortPostMessage(distortions: DistortionMap) {
+  const descriptor = Object.getOwnPropertyDescriptor(window, 'postMessage');
+
+  function getPostMessageDistortion(originalMethod: unknown) {
+    return function postMessageDistortion(this: Window, ...args: unknown[]) {
+      // proxies can't be serialized by postMessage algorithm
+      // the only way to pass it through is to send a cloned version
+      // objects passed to postMessage should be clonable
+      try {
+        const newArgs: unknown[] = cloneDeep(args);
+        if (isFunction(originalMethod)) {
+          originalMethod.apply(this, newArgs);
+        }
+      } catch (e) {
+        throw new Error('postMessage arguments are invalid objects');
+      }
+    };
+  }
+
+  if (descriptor?.value) {
+    distortions.set(descriptor.value, getPostMessageDistortion);
+  }
+}
+
 /**
  * We define "live" APIs as APIs that can only be distorted in runtime on-the-fly and not at initialization
  * time like other distortions do.