@@ -2,7 +2,7 @@ import { useEffect, useState } from "react";
22
33/**
44 * Hook for receiving render data from parent window via postMessage
5- * This is used by iframe-based UI components that receive data from the MCP client
5+ * This is used by iframe-based UI components that receive data from an MCP client
66 *
77 * @template T - The type of data expected in the renderData payload
88 * @returns An object containing:
@@ -28,68 +28,43 @@ export function useRenderData<T = unknown>() {
2828 const [ error , setError ] = useState < string | null > ( null ) ;
2929
3030 useEffect ( ( ) => {
31- console . log ( "[useRenderData] Waiting for render data from parent..." ) ;
32-
33- // Listen for render data from parent window
3431 const handleMessage = ( event : MessageEvent ) => {
35- console . log ( "[useRenderData] Received message:" , event . data ) ;
36-
37- // Note: Origin validation is intentionally NOT performed here
38- // MCP-UI is designed to be universally embeddable from any MCP client
39- // (desktop apps, browser extensions, web apps with variable origins)
40- // For private/enterprise deployments requiring origin restrictions, see next.config.ts
41-
42- // Security: Message type validation - only accept expected message types
4332 if ( event . data ?. type !== "ui-lifecycle-iframe-render-data" ) {
4433 // Silently ignore messages that aren't for us
4534 return ;
4635 }
4736
48- // Security: Payload structure validation
4937 if ( ! event . data . payload || typeof event . data . payload !== "object" ) {
5038 const errorMsg = "Invalid payload structure received" ;
51- console . error ( `[useRenderData] ${ errorMsg } ` ) ;
5239 setError ( errorMsg ) ;
5340 setIsLoading ( false ) ;
5441 return ;
5542 }
5643
5744 const renderData = event . data . payload . renderData ;
58- console . log ( "[useRenderData] Received render data:" , renderData ) ;
5945
60- // Security: Validate data exists and is of expected type
6146 if ( renderData === undefined || renderData === null ) {
62- console . warn ( "[useRenderData] Received null/undefined renderData" ) ;
6347 setIsLoading ( false ) ;
6448 // Not an error - parent may intentionally send null
6549 return ;
6650 }
6751
68- // Security: Basic type checking - ensure data matches expected structure
6952 if ( typeof renderData !== "object" ) {
7053 const errorMsg = `Expected object but received ${ typeof renderData } ` ;
71- console . error ( `[useRenderData] ${ errorMsg } ` ) ;
7254 setError ( errorMsg ) ;
7355 setIsLoading ( false ) ;
7456 return ;
7557 }
7658
77- // Note: XSS prevention is handled by React's automatic escaping when rendering
78- // If you need to render raw HTML (dangerouslySetInnerHTML), sanitize with DOMPurify
79- // Note: Schema validation is handled by the components themselves
8059 setData ( renderData as T ) ;
8160 setIsLoading ( false ) ;
8261 setError ( null ) ;
8362 } ;
8463
8564 window . addEventListener ( "message" , handleMessage ) ;
86-
87- // Notify parent we're ready to receive data
8865 window . parent . postMessage ( { type : "ui-lifecycle-iframe-ready" } , "*" ) ;
89- console . log ( "[useRenderData] Sent ui-lifecycle-iframe-ready to parent" ) ;
9066
9167 return ( ) => {
92- console . log ( "[useRenderData] Cleaning up message listener" ) ;
9368 window . removeEventListener ( "message" , handleMessage ) ;
9469 } ;
9570 } , [ ] ) ;
0 commit comments