3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	f857bb0a3f	fix: a request whose origin has no host is refused, not treated as a site (closes #527) ... A page with an opaque origin, such as one its server sandboxes with a Content-Security-Policy, is reported to the background with the origin "null", and Chrome reports a local file as "file://". The background took either as a site, so every such page was one site: a connection remembered for one covered them all, and the phishing check never matched. The background now parses the reported origin and, when it has no host, refuses the request with 4100 like one with no origin, before any method runs. tests/rpcOrigin.test.js sends both, and README's SiteApproval says what is refused. Model: opus-5-5	2026-10-16 04:44:49 +02:00
clawbot	1144fdb71b	harden: key remembered site permissions by full origin (closes #402) ... allowedSites and deniedSites held the bare hostname, so a grant to https://dapp.example also authorised http://dapp.example and every port on that host, and the connection, transaction and signature prompts named only the hostname. Both lists now store and match the full origin (scheme://host[:port]), the key the connections approved without Remember already used. The prompts, the Settings site lists and AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname are not migrated (pre-1.0): they match no site. Model: opus-5-5	2026-10-04 18:09:04 +02:00
clawbot	f24b5bca19	harden: take a request's origin from the frame that sent it (closes #407) ... Where the browser gives no sender.origin (Firefox before 126), the background credited a page's request to the tab's page, so a frame from another site counted as the site embedding it, and with no tab it used an origin the page wrote into the message. It now uses the origin of sender.url, the frame that sent the message, and refuses the request with code 4100 when the browser gives neither. The content script no longer writes an origin into the message. Model: opus-5-5	2026-10-04 17:26:05 +02:00