fix: low-severity security findings L3, L4, L5 (closes #6) #8

Merged
sneak merged 7 commits from fix/low-severity-security into main 2026-02-27 23:19:09 +01:00
2 changed files with 39 additions and 7 deletions
Showing only changes of commit 04a34d1a5e - Show all commits

View File

@@ -13,6 +13,23 @@ if (typeof browser !== "undefined") {
(document.head || document.documentElement).appendChild(script); (document.head || document.documentElement).appendChild(script);
} }
// Send the persisted EIP-6963 provider UUID to the inpage script.
// Generated once at install time and stored in chrome.storage.local.
(function sendProviderUuid() {
const storage =
typeof browser !== "undefined"
? browser.storage.local
: chrome.storage.local;
storage.get("eip6963Uuid", (items) => {
let uuid = items?.eip6963Uuid;
if (!uuid) {
uuid = crypto.randomUUID();
storage.set({ eip6963Uuid: uuid });
}
window.postMessage({ type: "AUTISTMASK_PROVIDER_UUID", uuid }, "*");
});
})();
// Relay requests from the page to the background script // Relay requests from the page to the background script
window.addEventListener("message", (event) => { window.addEventListener("message", (event) => {
if (event.source !== window) return; if (event.source !== window) return;

View File

@@ -155,21 +155,36 @@
"</svg>", "</svg>",
); );
const providerInfo = { let providerUuid = crypto.randomUUID(); // fallback until real UUID arrives
uuid: "f3c5b2a1-8d4e-4f6a-9c7b-1e2d3a4b5c6d",
name: "AutistMask", function buildProviderInfo() {
icon: ICON_SVG, return {
rdns: "berlin.sneak.autistmask", uuid: providerUuid,
}; name: "AutistMask",
icon: ICON_SVG,
rdns: "berlin.sneak.autistmask",
};
}
function announceProvider() { function announceProvider() {
window.dispatchEvent( window.dispatchEvent(
new CustomEvent("eip6963:announceProvider", { new CustomEvent("eip6963:announceProvider", {
detail: Object.freeze({ info: providerInfo, provider }), detail: Object.freeze({
info: buildProviderInfo(),
provider,
}),
}), }),
); );
} }
// Listen for the persisted UUID from the content script
window.addEventListener("message", (event) => {
if (event.source !== window) return;
if (event.data?.type !== "AUTISTMASK_PROVIDER_UUID") return;
providerUuid = event.data.uuid;
announceProvider();
});
window.addEventListener("eip6963:requestProvider", announceProvider); window.addEventListener("eip6963:requestProvider", announceProvider);
announceProvider(); announceProvider();
})(); })();