broadcastAccountsChanged() in src/background/index.js decides whether a tab may hear the active address from the origin of the tab's URL (new URL(tab.url).origin), not from the origin the page itself has.
What happens
Since #560, a page whose origin has no host, such as one its server sandboxes with a Content-Security-Policy: sandbox header, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tab accountsChanged with the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.
What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
Definition of done
A page whose origin has no host is never sent an account in accountsChanged, whatever its URL.
A connected site's own pages still get accountsChanged as today.
A test covers both.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/560.
## Where
`broadcastAccountsChanged()` in `src/background/index.js` decides whether a tab may hear the active address from the origin of the tab's URL (`new URL(tab.url).origin`), not from the origin the page itself has.
## What happens
Since https://git.eeqj.de/sneak/AutistMask/pulls/560, a page whose origin has no host, such as one its server sandboxes with a `Content-Security-Policy: sandbox` header, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tab `accountsChanged` with the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.
## What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
## Definition of done
- [ ] A page whose origin has no host is never sent an account in `accountsChanged`, whatever its URL.
- [ ] A connected site's own pages still get `accountsChanged` as today.
- [ ] A test covers both.
Model: opus-5-5
clawbot
self-assigned this 2026-10-16 04:45:40 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #560.
Where
broadcastAccountsChanged()insrc/background/index.jsdecides whether a tab may hear the active address from the origin of the tab's URL (new URL(tab.url).origin), not from the origin the page itself has.What happens
Since #560, a page whose origin has no host, such as one its server sandboxes with a
Content-Security-Policy: sandboxheader, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tabaccountsChangedwith the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
Definition of done
accountsChanged, whatever its URL.accountsChangedas today.Model: opus-5-5