WearablePreview controller accepts postMessage from any origin (no origin/source validation)

[braianj]

Summary

src/components/WearablePreview/WearablePreview.controller.ts:99 registers window.addEventListener('message', handleControllerMessage, false) and handleControllerMessage processes CONTROLLER_RESPONSE/EMOTE_EVENT/LOAD messages with no event.origin or event.source validation. Any frame/window on the page can resolve/reject the controller's pending promises with attacker-controlled payloads.

Impact

Consuming apps that embed WearablePreview receive forged controller responses/events from an untrusted source. (Same class as the legacy ui controller and the auth AvatarSetupPage handler.)

Fix

Validate event.origin against the iframe's src origin and/or event.source === iframe.contentWindow before processing.