A page with an opaque origin, such as one its server sends with a sandbox Content-Security-Policy, is reported by the browser with the origin "null". Chrome reports a page opened from a local file as file://. The background took either string as a site, so every such page shared one connection, and the phishing banner never showed for them. The background now parses the reported origin and, when it has no host, refuses the request with 4100 and the same message as a request with no origin. The refusal comes before any method is handled, so no prompt opens.
It does not fall back to the page's URL. A server that sandboxes a page is saying the page does not belong to its own site, so crediting the request to the site in the URL would hand that site's connection to the page.
Chrome runs the content scripts on a local file only after the user allows the extension access to file URLs, so the file:// case needs that setting turned on.
tests/rpcOrigin.test.js sends one request with sender.origin set to "null" and a URL on a connected site, and one with file://, and expects both refused. The README's SiteApproval section says what is refused.
Unverified: no browser test serves a sandboxed page or a local file. The "null" value comes from the browsers' documentation and the file:// value from Chrome's source code; neither has been observed here.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/AutistMask/issues/527.
A page with an opaque origin, such as one its server sends with a `sandbox` Content-Security-Policy, is reported by the browser with the origin `"null"`. Chrome reports a page opened from a local file as `file://`. The background took either string as a site, so every such page shared one connection, and the phishing banner never showed for them. The background now parses the reported origin and, when it has no host, refuses the request with 4100 and the same message as a request with no origin. The refusal comes before any method is handled, so no prompt opens.
It does not fall back to the page's URL. A server that sandboxes a page is saying the page does not belong to its own site, so crediting the request to the site in the URL would hand that site's connection to the page.
Chrome runs the content scripts on a local file only after the user allows the extension access to file URLs, so the `file://` case needs that setting turned on.
`tests/rpcOrigin.test.js` sends one request with `sender.origin` set to `"null"` and a URL on a connected site, and one with `file://`, and expects both refused. The README's SiteApproval section says what is refused.
Unverified: no browser test serves a sandboxed page or a local file. The `"null"` value comes from the browsers' documentation and the `file://` value from Chrome's source code; neither has been observed here.
Model: opus-5-5
src/background/index.js, the origin check in the AUTISTMASK_RPC listener: the definition of done on #527 asks that a request be refused with 4100 when its reported origin is "null"or anything else that is not scheme://host[:port]. Only "null" is refused. Chrome reports a page opened from a local file with the origin file://, which has no host, and the content scripts run on such pages once the user allows the extension access to file URLs, because both manifests inject them on all URLs. The background takes file:// as a site, so every local HTML file the user opens is the same site: a connection remembered for one of them connects them all with no prompt. This is the defect the issue describes for "null". The PR body's judgement call says only the two forms can arrive, and that is wrong for Chrome. Acceptable: refuse any reported origin that has no host, which covers both "null" and file://. Add a test to tests/rpcOrigin.test.js that sends a request with sender.origin set to file://, and make the README's SiteApproval sentence describe what is actually refused.
Unverified: I took the file:// value from Chrome's source code and did not see it in a running browser.
Model: opus-5-5
**FAIL** (needs-rework)
1. `src/background/index.js`, the origin check in the `AUTISTMASK_RPC` listener: the definition of done on https://git.eeqj.de/sneak/AutistMask/issues/527 asks that a request be refused with 4100 when its reported origin is `"null"` *or anything else that is not `scheme://host[:port]`*. Only `"null"` is refused. Chrome reports a page opened from a local file with the origin `file://`, which has no host, and the content scripts run on such pages once the user allows the extension access to file URLs, because both manifests inject them on all URLs. The background takes `file://` as a site, so every local HTML file the user opens is the same site: a connection remembered for one of them connects them all with no prompt. This is the defect the issue describes for `"null"`. The PR body's judgement call says only the two forms can arrive, and that is wrong for Chrome. Acceptable: refuse any reported origin that has no host, which covers both `"null"` and `file://`. Add a test to `tests/rpcOrigin.test.js` that sends a request with `sender.origin` set to `file://`, and make the README's SiteApproval sentence describe what is actually refused.
Unverified: I took the `file://` value from Chrome's source code and did not see it in a running browser.
Model: opus-5-5
A page with an opaque origin, such as one its server sandboxes with a
Content-Security-Policy, is reported to the background with the origin
"null", and Chrome reports a local file as "file://". The background took
either as a site, so every such page was one site: a connection remembered
for one covered them all, and the phishing check never matched. The
background now parses the reported origin and, when it has no host, refuses
the request with 4100 like one with no origin, before any method runs.
tests/rpcOrigin.test.js sends both, and README's SiteApproval says what is
refused.
Model: opus-5-5
clawbot
changed title from fix: a page with an opaque origin is refused, not treated as a site (closes #527) to fix: a request whose origin has no host is refused, not treated as a site (closes #527)2026-10-16 04:27:10 +02:00
src/background/index.js now parses the reported origin and refuses with 4100 any origin that has no host, so "null" and file:// are both refused by the same check.
tests/rpcOrigin.test.js has a new test that sends sender.origin set to file://.
The README's SiteApproval sentence says a request whose origin has no host is refused, with null and file:// as examples.
The PR body no longer has the judgement call that only two forms can arrive.
Unverified: the file:// value comes from the review and Chrome's source code, not from a running browser.
Model: opus-5-5
Rework for https://git.eeqj.de/sneak/AutistMask/pulls/560#issuecomment-144532:
- `src/background/index.js` now parses the reported origin and refuses with 4100 any origin that has no host, so `"null"` and `file://` are both refused by the same check.
- `tests/rpcOrigin.test.js` has a new test that sends `sender.origin` set to `file://`.
- The README's SiteApproval sentence says a request whose origin has no host is refused, with `null` and `file://` as examples.
- The PR body no longer has the judgement call that only two forms can arrive.
Unverified: the `file://` value comes from the review and Chrome's source code, not from a running browser.
Model: opus-5-5
PASS: a request whose reported origin has no host, null and file:// among them, is refused with 4100 before any prompt opens, every real site origin, including one with a port or an IPv6 host, is still accepted, and the finding in #560 (comment) is resolved.
Unverified: neither value was seen from a running browser; both come from the browsers' documentation and Chrome's source code.
Judgement call: no test sends an origin whose host is an IPv6 address; the check accepts such an origin, and I did not require a test for it.
Model: opus-5-5
**PASS**: a request whose reported origin has no host, `null` and `file://` among them, is refused with 4100 before any prompt opens, every real site origin, including one with a port or an IPv6 host, is still accepted, and the finding in https://git.eeqj.de/sneak/AutistMask/pulls/560#issuecomment-144532 is resolved.
Unverified: neither value was seen from a running browser; both come from the browsers' documentation and Chrome's source code.
Judgement call: no test sends an origin whose host is an IPv6 address; the check accepts such an origin, and I did not require a test for it.
Model: opus-5-5
clawbot
merged commit f857bb0a3f into next2026-10-16 04:44:50 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #527.
A page with an opaque origin, such as one its server sends with a
sandboxContent-Security-Policy, is reported by the browser with the origin"null". Chrome reports a page opened from a local file asfile://. The background took either string as a site, so every such page shared one connection, and the phishing banner never showed for them. The background now parses the reported origin and, when it has no host, refuses the request with 4100 and the same message as a request with no origin. The refusal comes before any method is handled, so no prompt opens.It does not fall back to the page's URL. A server that sandboxes a page is saying the page does not belong to its own site, so crediting the request to the site in the URL would hand that site's connection to the page.
Chrome runs the content scripts on a local file only after the user allows the extension access to file URLs, so the
file://case needs that setting turned on.tests/rpcOrigin.test.jssends one request withsender.originset to"null"and a URL on a connected site, and one withfile://, and expects both refused. The README's SiteApproval section says what is refused.Unverified: no browser test serves a sandboxed page or a local file. The
"null"value comes from the browsers' documentation and thefile://value from Chrome's source code; neither has been observed here.Model: opus-5-5
FAIL (needs-rework)
src/background/index.js, the origin check in theAUTISTMASK_RPClistener: the definition of done on #527 asks that a request be refused with 4100 when its reported origin is"null"or anything else that is notscheme://host[:port]. Only"null"is refused. Chrome reports a page opened from a local file with the originfile://, which has no host, and the content scripts run on such pages once the user allows the extension access to file URLs, because both manifests inject them on all URLs. The background takesfile://as a site, so every local HTML file the user opens is the same site: a connection remembered for one of them connects them all with no prompt. This is the defect the issue describes for"null". The PR body's judgement call says only the two forms can arrive, and that is wrong for Chrome. Acceptable: refuse any reported origin that has no host, which covers both"null"andfile://. Add a test totests/rpcOrigin.test.jsthat sends a request withsender.originset tofile://, and make the README's SiteApproval sentence describe what is actually refused.Unverified: I took the
file://value from Chrome's source code and did not see it in a running browser.Model: opus-5-5
9adae6c9c7to7748e49aa8fix: a page with an opaque origin is refused, not treated as a site (closes #527)to fix: a request whose origin has no host is refused, not treated as a site (closes #527)Rework for #560 (comment):
src/background/index.jsnow parses the reported origin and refuses with 4100 any origin that has no host, so"null"andfile://are both refused by the same check.tests/rpcOrigin.test.jshas a new test that sendssender.originset tofile://.nullandfile://as examples.Unverified: the
file://value comes from the review and Chrome's source code, not from a running browser.Model: opus-5-5
PASS: a request whose reported origin has no host,
nullandfile://among them, is refused with 4100 before any prompt opens, every real site origin, including one with a port or an IPv6 host, is still accepted, and the finding in #560 (comment) is resolved.Unverified: neither value was seen from a running browser; both come from the browsers' documentation and Chrome's source code.
Judgement call: no test sends an origin whose host is an IPv6 address; the check accepts such an origin, and I did not require a test for it.
Model: opus-5-5