fix: a request whose origin has no host is refused, not treated as a site (closes #527)

A page with an opaque origin, such as one its server sandboxes with a
Content-Security-Policy, is reported to the background with the origin
"null", and Chrome reports a local file as "file://". The background took
either as a site, so every such page was one site: a connection remembered
for one covered them all, and the phishing check never matched. The
background now parses the reported origin and, when it has no host, refuses
the request with 4100 like one with no origin, before any method runs.
tests/rpcOrigin.test.js sends both, and README's SiteApproval says what is
refused.

Model: opus-5-5

tests/rpcOrigin.test.js

@@ -8,8 +8,15 @@
 // and a request the browser said nothing about was credited to whatever the
 // page wrote (https://git.eeqj.de/sneak/AutistMask/issues/407).
 //
-// Every sender here lacks sender.origin, as on old Firefox. The connection
-// check on eth_accounts is what shows which site a request was credited to.
+// An origin with no host names no site, so its request is refused
+// (https://git.eeqj.de/sneak/AutistMask/issues/527). The browser reports
+// "null" for a page with an opaque origin, such as one its server sandboxes
+// with a Content-Security-Policy, and Chrome reports "file://" for a local
+// file.
+//
+// Every other sender here lacks sender.origin, as on old Firefox. The
+// connection check on eth_accounts is what shows which site a request was
+// credited to.
 
 const { makeStorageStub } = require("./support/storageStub");
 
@@ -144,3 +151,41 @@ describe("a request the browser does not say the sender of", () => {
         });
     });
 });
+
+describe("a request whose origin has no host", () => {
+    test("from a page with an opaque origin is refused, whatever its URL says", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts({
+            origin: "null",
+            url: CONNECTED_ORIGIN + "/sandboxed.html",
+            tab: { url: CONNECTED_ORIGIN + "/sandboxed.html" },
+        });
+
+        expect(result).toEqual({
+            error: {
+                code: 4100,
+                message:
+                    "The wallet could not tell which site sent this request.",
+            },
+        });
+    });
+
+    test("from a local file is refused", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts({
+            origin: "file://",
+            url: "file:///home/user/page.html",
+            tab: { url: "file:///home/user/page.html" },
+        });
+
+        expect(result).toEqual({
+            error: {
+                code: 4100,
+                message:
+                    "The wallet could not tell which site sent this request.",
+            },
+        });
+    });
+});