harden: origin attribution falls back to the top-level tab URL and then to the page-supplied origin #407

New Issue

2026-09-21T20:37:56+02:00

clawbot commented

2026-09-21 20:37:56 +02:00

Severity: hardening.

Where. src/background/index.js:1269-1283 (the AUTISTMASK_RPC handler:
sender.origin, else new URL(sender.tab.url).origin, else msg.origin).

What is wrong. When sender.origin is absent (Firefox before 126) the
handler attributes the request to the top-level tab URL, so a cross-origin
iframe's request is credited to the embedding page; the final fallback trusts
msg.origin, a value carried in the message. sender.url — the URL of the frame
that actually sent the message — is never consulted.

Why it matters. On out-of-support Firefox a hostile iframe on a connected
site inherits the embedding site's connection and prompts appear under the
embedding site's name. On current browsers sender.origin is always present, so
there is no effect there; the msg.origin fallback is unreachable for a genuine
content-script sender (there is no externally_connectable). This is
defence-in-depth and hygiene rather than a live hole on supported browsers.

Acceptable. Prefer sender.origin, then new URL(sender.url).origin, and
refuse the request when neither is available rather than trusting msg.origin.

Definition of done.

Origin is taken from sender.origin, then sender.url; the msg.origin
fallback is removed.
A request with neither trusted source is refused.
A test asserts an iframe sender is attributed to the frame origin, not the
top-level tab.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/background/index.js:1269-1283` (the `AUTISTMASK_RPC` handler: `sender.origin`, else `new URL(sender.tab.url).origin`, else `msg.origin`). **What is wrong.** When `sender.origin` is absent (Firefox before 126) the handler attributes the request to the top-level tab URL, so a cross-origin iframe's request is credited to the embedding page; the final fallback trusts `msg.origin`, a value carried in the message. `sender.url` — the URL of the frame that actually sent the message — is never consulted. **Why it matters.** On out-of-support Firefox a hostile iframe on a connected site inherits the embedding site's connection and prompts appear under the embedding site's name. On current browsers `sender.origin` is always present, so there is no effect there; the `msg.origin` fallback is unreachable for a genuine content-script sender (there is no `externally_connectable`). This is defence-in-depth and hygiene rather than a live hole on supported browsers. **Acceptable.** Prefer `sender.origin`, then `new URL(sender.url).origin`, and refuse the request when neither is available rather than trusting `msg.origin`. **Definition of done.** - [ ] Origin is taken from `sender.origin`, then `sender.url`; the `msg.origin` fallback is removed. - [ ] A request with neither trusted source is refused. - [ ] A test asserts an iframe sender is attributed to the frame origin, not the top-level tab. Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#407