sneak/AutistMask
1
0
Fork 0
Code Issues 23 Pull Requests 3 Actions 82 Packages Projects Releases Wiki Activity

fix: a page whose origin has no host is never told an address by accountsChanged (closes #564)
check / check (push) Canceled after 0s
Details
e2e / e2e-chrome (push) Canceled after 0s
Details
e2e / e2e-firefox (push) Canceled after 0s
Details

Browse Source 
On an address switch the background judges each tab by the origin of its URL. A page its server sandboxes has the origin "null" at a connected site's URL, and was sent the new active address. The background now names the origin it judged by on each accountsChanged event, and the content script passes the address on only when the page's own origin (window.origin) is that one; otherwise the page gets an empty list.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-18 22:10:25 +00:00
parent 8b0a1bff02
commit d79d48f6ec
4 changed files with 203 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -8
View File
@@ -2175,14 +2175,17 @@ view would leave a wallet one click from deletion.
code `4100` and opens no prompt. Two such origins are `null`, which the
browser reports for a page with an opaque origin, such as one its server
sandboxes with a Content-Security-Policy, and `file://`, which Chrome reports
for a local file. The background script prefers the toolbar popup
(`action.openPopup()`) and falls back to a separate popup window
(`src/background/index.js`, `requestApproval()`). Only one exists per site at
a time: a further connection request from a site whose prompt is still
unanswered is refused with EIP-1193 code `-32002` and opens no new prompt. If
that prompt was in a toolbar popup that closed before it connected, and the
toolbar popup has since been set to open something else, the refused request
shows that prompt again.
for a local file. Nor is such a page told the active address by
`accountsChanged`, even at a connected site's URL: the background names the
origin of the tab's URL on the event, and the content script passes the
address on only to a page whose own origin is that one. The background script
prefers the toolbar popup (`action.openPopup()`) and falls back to a separate
popup window (`src/background/index.js`, `requestApproval()`). Only one exists
per site at a time: a further connection request from a site whose prompt is
still unanswered is refused with EIP-1193 code `-32002` and opens no new
prompt. If that prompt was in a toolbar popup that closed before it connected,
and the toolbar popup has since been set to open something else, the refused
request shows that prompt again.
- **Elements**:
- "Connection Request" heading
- Phishing warning banner (shown when the hostname is on the phishing