broadcastAccountsChanged() in src/background/index.js decides whether a tab may hear the active address from the origin of the tab's URL (new URL(tab.url).origin), not from the origin the page itself has.
What happens
Since #560, a page whose origin has no host, such as one its server sandboxes with a Content-Security-Policy: sandbox header, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tab accountsChanged with the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.
What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
Definition of done
A page whose origin has no host is never sent an account in accountsChanged, whatever its URL.
A connected site's own pages still get accountsChanged as today.
A test covers both.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/560.
## Where
`broadcastAccountsChanged()` in `src/background/index.js` decides whether a tab may hear the active address from the origin of the tab's URL (`new URL(tab.url).origin`), not from the origin the page itself has.
## What happens
Since https://git.eeqj.de/sneak/AutistMask/pulls/560, a page whose origin has no host, such as one its server sandboxes with a `Content-Security-Policy: sandbox` header, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tab `accountsChanged` with the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.
## What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
## Definition of done
- [ ] A page whose origin has no host is never sent an account in `accountsChanged`, whatever its URL.
- [ ] A connected site's own pages still get `accountsChanged` as today.
- [ ] A test covers both.
Model: opus-5-5
clawbot
self-assigned this 2026-10-16 04:45:40 +02:00
Plan: the background only knows a tab's URL, and the page's own origin is known for certain only inside the page's content script, so the check goes there. broadcastAccountsChanged() in src/background/index.js puts the origin it judged by (the tab URL's origin) on each accountsChanged event it sends. The listener in src/content/index.js passes an event that carries an address to the page only when the page's own origin (window.origin) is that origin; otherwise it passes []. A page whose origin has no host has window.origin"null", which never matches, so it never hears an address, whatever its URL. Events with no address ([], chainChanged) pass as today. No new module. Tests, in a new tests/accountsChangedOpaqueOrigin.test.js: the content script given an accountsChanged with an address for https://dapp.example passes it on when its page's origin is https://dapp.example, and passes [] when the page's origin is "null"; and the background puts the origin on the event.
Model: opus-5-5
Plan: the background only knows a tab's URL, and the page's own origin is known for certain only inside the page's content script, so the check goes there. `broadcastAccountsChanged()` in `src/background/index.js` puts the origin it judged by (the tab URL's origin) on each `accountsChanged` event it sends. The listener in `src/content/index.js` passes an event that carries an address to the page only when the page's own origin (`window.origin`) is that origin; otherwise it passes `[]`. A page whose origin has no host has `window.origin` `"null"`, which never matches, so it never hears an address, whatever its URL. Events with no address (`[]`, `chainChanged`) pass as today. No new module. Tests, in a new `tests/accountsChangedOpaqueOrigin.test.js`: the content script given an `accountsChanged` with an address for `https://dapp.example` passes it on when its page's origin is `https://dapp.example`, and passes `[]` when the page's origin is `"null"`; and the background puts the origin on the event.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #560.
Where
broadcastAccountsChanged()insrc/background/index.jsdecides whether a tab may hear the active address from the origin of the tab's URL (new URL(tab.url).origin), not from the origin the page itself has.What happens
Since #560, a page whose origin has no host, such as one its server sandboxes with a
Content-Security-Policy: sandboxheader, has every request refused with 4100 and is not treated as the site its URL names. But when the user switches address, the background sends that tabaccountsChangedwith the new active address whenever the site its URL names is connected. A sandboxed page at a connected site's URL, which may hold content the site does not trust, such as a user's upload, learns the address it cannot ask for.What should happen
README, SiteApproval: a page whose origin has no host is not treated as a site. Such a page should get no account from any event, as it gets none from a request.
Severity: minor
Definition of done
accountsChanged, whatever its URL.accountsChangedas today.Model: opus-5-5
Plan: the background only knows a tab's URL, and the page's own origin is known for certain only inside the page's content script, so the check goes there.
broadcastAccountsChanged()insrc/background/index.jsputs the origin it judged by (the tab URL's origin) on eachaccountsChangedevent it sends. The listener insrc/content/index.jspasses an event that carries an address to the page only when the page's own origin (window.origin) is that origin; otherwise it passes[]. A page whose origin has no host haswindow.origin"null", which never matches, so it never hears an address, whatever its URL. Events with no address ([],chainChanged) pass as today. No new module. Tests, in a newtests/accountsChangedOpaqueOrigin.test.js: the content script given anaccountsChangedwith an address forhttps://dapp.examplepasses it on when its page's origin ishttps://dapp.example, and passes[]when the page's origin is"null"; and the background puts the origin on the event.Model: opus-5-5
clawbot referenced this issue2026-10-19 00:00:03 +02:00