L5: truncate token name and symbol to prevent UI abuse

Limit token name to 64 characters and symbol to 12 characters after
fetching from the contract. Prevents malicious contracts from injecting
excessively long strings into the UI.

src/content/index.js

@@ -24,10 +24,7 @@ storageApi.local.get("providerUUID", (res) => {
         uuid = crypto.randomUUID();
         storageApi.local.set({ providerUUID: uuid });
     }
-    window.postMessage(
+    window.postMessage({ type: "AUTISTMASK_PROVIDER_UUID", uuid }, "*");
-        { type: "AUTISTMASK_PROVIDER_UUID", uuid },
-        "*",
-    );
 });
 
 // Relay requests from the page to the background script

src/shared/balances.js

@@ -192,6 +192,10 @@ async function lookupTokenInfo(contractAddress, rpcUrl) {
         name = symbol;
     }
 
+    // Truncate name and symbol to prevent abuse via malicious contracts.
+    name = String(name).slice(0, 64);
+    symbol = String(symbol).slice(0, 12);
+
     log.infof("Token resolved:", symbol, "decimals", Number(decimals));
     return { name, symbol, decimals: Number(decimals) };
 }