fix: low-severity security findings L3, L4, L5 (closes #6) #8
@@ -13,6 +13,23 @@ if (typeof browser !== "undefined") {
|
||||
(document.head || document.documentElement).appendChild(script);
|
||||
}
|
||||
|
||||
// Send the persisted EIP-6963 provider UUID to the inpage script.
|
||||
// Generated once at install time and stored in chrome.storage.local.
|
||||
(function sendProviderUuid() {
|
||||
const storage =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
storage.get("eip6963Uuid", (items) => {
|
||||
let uuid = items?.eip6963Uuid;
|
||||
if (!uuid) {
|
||||
uuid = crypto.randomUUID();
|
||||
storage.set({ eip6963Uuid: uuid });
|
||||
}
|
||||
window.postMessage({ type: "AUTISTMASK_PROVIDER_UUID", uuid }, "*");
|
||||
});
|
||||
})();
|
||||
|
||||
// Relay requests from the page to the background script
|
||||
window.addEventListener("message", (event) => {
|
||||
if (event.source !== window) return;
|
||||
|
||||
@@ -155,21 +155,36 @@
|
||||
"</svg>",
|
||||
);
|
||||
|
||||
const providerInfo = {
|
||||
uuid: "f3c5b2a1-8d4e-4f6a-9c7b-1e2d3a4b5c6d",
|
||||
name: "AutistMask",
|
||||
icon: ICON_SVG,
|
||||
rdns: "berlin.sneak.autistmask",
|
||||
};
|
||||
let providerUuid = crypto.randomUUID(); // fallback until real UUID arrives
|
||||
|
||||
function buildProviderInfo() {
|
||||
return {
|
||||
uuid: providerUuid,
|
||||
name: "AutistMask",
|
||||
icon: ICON_SVG,
|
||||
rdns: "berlin.sneak.autistmask",
|
||||
};
|
||||
}
|
||||
|
||||
function announceProvider() {
|
||||
window.dispatchEvent(
|
||||
new CustomEvent("eip6963:announceProvider", {
|
||||
detail: Object.freeze({ info: providerInfo, provider }),
|
||||
detail: Object.freeze({
|
||||
info: buildProviderInfo(),
|
||||
provider,
|
||||
}),
|
||||
}),
|
||||
);
|
||||
}
|
||||
|
||||
// Listen for the persisted UUID from the content script
|
||||
window.addEventListener("message", (event) => {
|
||||
if (event.source !== window) return;
|
||||
if (event.data?.type !== "AUTISTMASK_PROVIDER_UUID") return;
|
||||
providerUuid = event.data.uuid;
|
||||
announceProvider();
|
||||
});
|
||||
|
||||
window.addEventListener("eip6963:requestProvider", announceProvider);
|
||||
announceProvider();
|
||||
})();
|
||||
|
||||
Reference in New Issue
Block a user