Mail.ru: [XSS] postMessage в jsapi/button

XSS via postMessage handler in o2.mail.ru...

Mail.ru: invalid handling of redirect_uri at o2.mail.ru/jsapi/button

o2.mail.ru/jsapi/button gets embedded as login window in website that using o2 oauth. parameter redirecturi by default may have either value of white listed domain from particular app by clientId either it may lead to .mail.ru, then it contacts with parent window via postmessages. Other domains a...