Grimhacker

An issue was discovered in the `postData()` function in `xdLocalStoragePostMessageApi.js`, which specifies the wildcard (`*`) as the `targetOrigin` when calling the `postMessage()` function on the parent object. This allows any domain to load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.

An issue was discovered in the `buildMessage()` function in xdLocalStorage.js, which specifies the wildcard (*) as the `targetOrigin` when calling the `postMessage()` function on the iframe object. This allows any domain currently loaded within the iframe to receive the messages that the client sends.