harden: a session (non-remembered) site connection cannot be revoked from the UI, and the remove-site message does nothing #406

New Issue

2026-09-21T20:37:56+02:00

clawbot commented

2026-09-21 20:37:56 +02:00

Severity: hardening.

Where. src/background/index.js:60 (connectedSites), 646-651 (a
non-remembered Allow only sets connectedSites), 1650-1653
(AUTISTMASK_REMOVE_SITE handler is a no-op); src/popup/views/settings.js:37-70
(Settings lists only remembered hostnames).

What is wrong. A site connected without "Remember" lives only in the
in-memory connectedSites map. Settings lists only remembered hostnames, so such
a connection is neither shown nor revocable, and the AUTISTMASK_REMOVE_SITE
message the popup sends on a remove does nothing in the background. A session
connection ends only on an address switch or a worker restart (and on Firefox's
persistent background page, not until the browser restarts).

Why it matters. The user cannot disconnect a site they connected, and
Settings gives an incomplete picture of who is connected.

Reproduction. Connect to a site without Remember; open Settings — the site is
not listed and there is no control to disconnect it.

Acceptable. Show live session connections in Settings, and make removal (and
AUTISTMASK_REMOVE_SITE) delete the matching connectedSites entries and
broadcast accountsChanged [] to that origin.

Definition of done.

Settings shows live session connections as well as remembered ones.
Removing a site clears both the remembered entry and any matching
connectedSites entry, and notifies the tab.
A test asserts a removed site no longer returns the address from
eth_accounts.

Related: #245

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/background/index.js:60` (`connectedSites`), `646-651` (a non-remembered Allow only sets `connectedSites`), `1650-1653` (`AUTISTMASK_REMOVE_SITE` handler is a no-op); `src/popup/views/settings.js:37-70` (Settings lists only remembered hostnames). **What is wrong.** A site connected without "Remember" lives only in the in-memory `connectedSites` map. Settings lists only remembered hostnames, so such a connection is neither shown nor revocable, and the `AUTISTMASK_REMOVE_SITE` message the popup sends on a remove does nothing in the background. A session connection ends only on an address switch or a worker restart (and on Firefox's persistent background page, not until the browser restarts). **Why it matters.** The user cannot disconnect a site they connected, and Settings gives an incomplete picture of who is connected. **Reproduction.** Connect to a site without Remember; open Settings — the site is not listed and there is no control to disconnect it. **Acceptable.** Show live session connections in Settings, and make removal (and `AUTISTMASK_REMOVE_SITE`) delete the matching `connectedSites` entries and broadcast `accountsChanged []` to that origin. **Definition of done.** - [ ] Settings shows live session connections as well as remembered ones. - [ ] Removing a site clears both the remembered entry and any matching `connectedSites` entry, and notifies the tab. - [ ] A test asserts a removed site no longer returns the address from `eth_accounts`. Related: https://git.eeqj.de/sneak/AutistMask/issues/245 Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#406