security: announce a fresh EIP-6963 provider UUID per page load (closes #398) #412

Open
clawbot wants to merge 1 commits from issue-398-fresh-provider-uuid into next
Collaborator

Closes #398.

The EIP-6963 provider UUID was generated once, stored in extension storage,
and announced verbatim to every page on every load and across restarts, so any
site — connected or not — could read a stable cross-site, cross-session
identifier for the install: a supercookie contradicting the README's "no
tracking". EIP-6963 wants a fresh UUIDv4 per announcement.

src/content/inpage.js now announces a per-load crypto.randomUUID() and
persists nothing. The eip6963Uuid storage key and the
AUTISTMASK_PROVIDER_UUID content-script message are removed, along with the
now-unused storageGet/storageSet imports in src/content/index.js.

What the diff does not show: eip6963Uuid was a standalone top-level storage
entry, never a field of the versioned autistmask profile, so
stateSchema.js and the persisted-field harness need no change and no existing
profile is affected. A stale value from an older install is read by no code
after this change and is not reachable by web pages; nothing depends on the
UUID being stable.

tests/inpageProviderUuid.test.js drives inpage.js against a stub window and
asserts two loads announce different UUIDv4s while one load reuses a single
UUID across re-announcements. The Firefox e2e comment describing the removed
storage read is updated; its length check on the announced UUID still holds.

No README sentence describes the provider UUID, so none was changed.

make check is green locally.

Model: opus-4-8

Closes https://git.eeqj.de/sneak/AutistMask/issues/398. The EIP-6963 provider UUID was generated once, stored in extension storage, and announced verbatim to every page on every load and across restarts, so any site — connected or not — could read a stable cross-site, cross-session identifier for the install: a supercookie contradicting the README's "no tracking". EIP-6963 wants a fresh UUIDv4 per announcement. `src/content/inpage.js` now announces a per-load `crypto.randomUUID()` and persists nothing. The `eip6963Uuid` storage key and the `AUTISTMASK_PROVIDER_UUID` content-script message are removed, along with the now-unused `storageGet`/`storageSet` imports in `src/content/index.js`. What the diff does not show: `eip6963Uuid` was a standalone top-level storage entry, never a field of the versioned `autistmask` profile, so `stateSchema.js` and the persisted-field harness need no change and no existing profile is affected. A stale value from an older install is read by no code after this change and is not reachable by web pages; nothing depends on the UUID being stable. `tests/inpageProviderUuid.test.js` drives inpage.js against a stub window and asserts two loads announce different UUIDv4s while one load reuses a single UUID across re-announcements. The Firefox e2e comment describing the removed storage read is updated; its length check on the announced UUID still holds. No README sentence describes the provider UUID, so none was changed. `make check` is green locally. Model: opus-4-8
clawbot added 1 commit 2026-09-22 01:36:16 +02:00
security: announce a fresh EIP-6963 provider UUID per page load (closes #398)
e2e / e2e-chrome (push) Failing after 0s
e2e / e2e-firefox (push) Failing after 0s
check / check (push) Successful in 44s
60d2b24cd1
The provider UUID was generated once, stored in extension storage, and
announced verbatim to every page on every load and across restarts, so any
site — connected or not — could read a stable cross-site, cross-session
identifier for the install: a supercookie contradicting the "no tracking"
promise. EIP-6963 wants a fresh UUIDv4 per announcement instead.

inpage.js now announces a per-load crypto.randomUUID() and persists nothing;
the eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script
message are removed. That key was a standalone top-level storage entry, never
part of the versioned autistmask profile, so stateSchema.js and the
persisted-field harness are untouched and no existing profile is affected.

A jest test asserts two loads announce different UUIDv4s and that one load
reuses a single UUID across re-announcements.

Model: opus-4-8
clawbot self-assigned this 2026-09-22 01:36:24 +02:00
clawbot added this to the 1.0.0 milestone 2026-09-22 01:36:24 +02:00
clawbot added the needs-review label 2026-09-22 01:36:24 +02:00
Some required checks failed
e2e / e2e-chrome (push) Failing after 0s
e2e / e2e-firefox (push) Failing after 0s
check / check (push) Successful in 44s
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin issue-398-fresh-provider-uuid:issue-398-fresh-provider-uuid
git checkout issue-398-fresh-provider-uuid
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#412