From 9e1ffb2333b658e949230915869c98df11fa8b4a Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:19:10 -0700
Subject: [PATCH] fix(plugins): validate example panel reply dispatch (#31877)

* fix(plugins): validate example panel reply dispatch

* style(plugins): brace panel reply admission guard
---
 examples/plugins/hello-orca/panel.html        | 12 ++--
 .../plugins/hello-orca-panel-messages.test.ts | 61 +++++++++++++++++++
 2 files changed, 68 insertions(+), 5 deletions(-)
 create mode 100644 src/shared/plugins/hello-orca-panel-messages.test.ts

diff --git a/examples/plugins/hello-orca/panel.html b/examples/plugins/hello-orca/panel.html
index 6c7b5cf8181..d48db64d9c6 100644
--- a/examples/plugins/hello-orca/panel.html
+++ b/examples/plugins/hello-orca/panel.html
@@ -51,14 +51,14 @@
     <script>
       'use strict'
       var seq = 0
-      var pending = {}
+      var pending = new Map()
       var statusEl = document.getElementById('status')
       var termsEl = document.getElementById('terms')
 
       function call(action, params) {
         return new Promise(function (resolve) {
           var requestId = 'req-' + ++seq
-          pending[requestId] = resolve
+          pending.set(requestId, resolve)
           // The panel frame is an opaque origin, so '*' is the only usable
           // targetOrigin; the host verifies the sending window instead.
           window.parent.postMessage(
@@ -70,10 +70,12 @@
 
       window.addEventListener('message', function (event) {
         var data = event.data
-        if (!data || data.type !== 'orca-panel-action-result') return
-        var resolve = pending[data.requestId]
+        if (event.source !== window.parent || !data || data.type !== 'orca-panel-action-result') {
+          return
+        }
+        var resolve = pending.get(data.requestId)
         if (!resolve) return
-        delete pending[data.requestId]
+        pending.delete(data.requestId)
         resolve(data)
       })
 
diff --git a/src/shared/plugins/hello-orca-panel-messages.test.ts b/src/shared/plugins/hello-orca-panel-messages.test.ts
new file mode 100644
index 00000000000..d54a641dcda
--- /dev/null
+++ b/src/shared/plugins/hello-orca-panel-messages.test.ts
@@ -0,0 +1,61 @@
+import { readFileSync } from 'node:fs'
+import { createContext, runInContext } from 'node:vm'
+import { describe, expect, it, vi } from 'vitest'
+
+describe('hello-orca panel replies', () => {
+  it('only resolves an outstanding request once, from the parent window', async () => {
+    const parent = { postMessage: vi.fn() }
+    let receive: (event: { source: unknown; data: unknown }) => void = () => {
+      throw new Error('Panel did not register its message listener')
+    }
+    const context = createContext({
+      window: {
+        parent,
+        addEventListener: (name: string, listener: typeof receive) => {
+          if (name === 'message') {
+            receive = listener
+          }
+        }
+      },
+      document: { getElementById: () => ({ addEventListener: vi.fn() }) }
+    })
+    const html = readFileSync(
+      new URL('../../../examples/plugins/hello-orca/panel.html', import.meta.url),
+      'utf8'
+    )
+    const script = html.match(/<script>([\s\S]*?)<\/script>/)?.[1]
+    if (!script) {
+      throw new Error('Panel script missing')
+    }
+    runInContext(script, context)
+    const resolved = vi.fn()
+    const request = runInContext("call('workspace.readContext')", context).then(resolved)
+    const reply = {
+      type: 'orca-panel-action-result',
+      requestId: 'req-1',
+      ok: true,
+      value: null
+    }
+
+    for (const requestId of ['__proto__', 'constructor', '__defineGetter__', 'unknown']) {
+      expect(() => receive({ source: parent, data: { ...reply, requestId } })).not.toThrow()
+    }
+    receive({ source: {}, data: reply })
+    await Promise.resolve()
+    expect(resolved).not.toHaveBeenCalled()
+    receive({ source: parent, data: reply })
+    await request
+    expect(resolved).toHaveBeenCalledExactlyOnceWith(reply)
+    receive({ source: parent, data: reply })
+    expect(runInContext('pending.size', context)).toBe(0)
+    expect(parent.postMessage).toHaveBeenCalledExactlyOnceWith(
+      {
+        type: 'orca-panel-action',
+        requestId: 'req-1',
+        action: 'workspace.readContext',
+        params: undefined
+      },
+      '*'
+    )
+  })
+})