When the user switches address, broadcastAccountsChanged() in src/background/index.js judges each tab by the origin of its URL, the only origin the background can see. A page its server sandboxes with a Content-Security-Policy has the origin null even at a connected site's URL. Since #560 every request from such a page is refused, yet it was still sent the new active address.
The background now names the origin it judged by on each accountsChanged event it sends there. The listener in src/content/index.js passes the address to the page only when the page's own window.origin is that origin, and an empty list otherwise. In a content script on both browsers, window.origin is the page's own origin, null on a sandboxed page; location.origin would give the URL's origin.
An accountsChanged that names no origin also reaches the page as an empty list. The only other sender, removal of a site in Settings, already sends one. chainChanged is unchanged.
One sentence added to the README's SiteApproval section says the same.
New file, in tests/: tests/accountsChangedOpaqueOrigin.test.js. It switches the address in the real background, takes the event sent to a tab at the site's URL, and hands it to the real content script in a page of the site's origin and in a page of origin null.
Judgement call: no browser-suite test was added; the unit test sets window.origin itself.
Model: opus-5-5
When the user switches address, `broadcastAccountsChanged()` in `src/background/index.js` judges each tab by the origin of its URL, the only origin the background can see. A page its server sandboxes with a Content-Security-Policy has the origin `null` even at a connected site's URL. Since https://git.eeqj.de/sneak/AutistMask/pulls/560 every request from such a page is refused, yet it was still sent the new active address.
The background now names the origin it judged by on each `accountsChanged` event it sends there. The listener in `src/content/index.js` passes the address to the page only when the page's own `window.origin` is that origin, and an empty list otherwise. In a content script on both browsers, `window.origin` is the page's own origin, `null` on a sandboxed page; `location.origin` would give the URL's origin.
An `accountsChanged` that names no origin also reaches the page as an empty list. The only other sender, removal of a site in Settings, already sends one. `chainChanged` is unchanged.
One sentence added to the README's SiteApproval section says the same.
New file, in `tests/`: `tests/accountsChangedOpaqueOrigin.test.js`. It switches the address in the real background, takes the event sent to a tab at the site's URL, and hands it to the real content script in a page of the site's origin and in a page of origin `null`.
Judgement call: no browser-suite test was added; the unit test sets `window.origin` itself.
Model: opus-5-5
On an address switch the background judges each tab by the origin of its URL. A page its server sandboxes has the origin "null" at a connected site's URL, and was sent the new active address. The background now names the origin it judged by on each accountsChanged event, and the content script passes the address on only when the page's own origin (window.origin) is that one; otherwise the page gets an empty list.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
When the user switches address,
broadcastAccountsChanged()insrc/background/index.jsjudges each tab by the origin of its URL, the only origin the background can see. A page its server sandboxes with a Content-Security-Policy has the originnulleven at a connected site's URL. Since #560 every request from such a page is refused, yet it was still sent the new active address.The background now names the origin it judged by on each
accountsChangedevent it sends there. The listener insrc/content/index.jspasses the address to the page only when the page's ownwindow.originis that origin, and an empty list otherwise. In a content script on both browsers,window.originis the page's own origin,nullon a sandboxed page;location.originwould give the URL's origin.An
accountsChangedthat names no origin also reaches the page as an empty list. The only other sender, removal of a site in Settings, already sends one.chainChangedis unchanged.One sentence added to the README's SiteApproval section says the same.
New file, in
tests/:tests/accountsChangedOpaqueOrigin.test.js. It switches the address in the real background, takes the event sent to a tab at the site's URL, and hands it to the real content script in a page of the site's origin and in a page of originnull.Judgement call: no browser-suite test was added; the unit test sets
window.originitself.Model: opus-5-5
Review passed.
Model: opus-5-5