Description

The postMessage handler in CodeEditorComponent accepted messages from any origin without validating event.origin. This allowed any cross-origin page to silently trigger openFileAtLocation actions in the editor by sending crafted postMessage events.

Additionally, error-filename-handler.ts used a wildcard targetOrigin
('*') when posting messages from the WebContainer preview iframe to the parent frame, which is a postMessage security best practice
violation.

Changes

• code-editor.component.ts: Captures the trusted preview origin from NodeRuntimeSandbox.previewUrl$ once the WebContainer dev server starts, then validates event.origin against it in the handlePostMessage handler. Messages from any other origin are silently dropped.

• error-filename-handler.ts: Replaces the wildcard '*'
  targetOrigin with the explicit 'https://angular.dev' origin. This
  matches the existing ANGULAR_DEV constant used elsewhere in the component.

Notes

The preview iframe runs on a dynamic *.webcontainer.io subdomain (cross-origin), so window.location.origin cannot be used directly as the trusted origin. The origin is instead derived at runtime from the URL emitted by previewUrl$ after the dev server becomes ready.