clawbot
fc042c3191
The background judges each tab by its URL's origin, the only one it can see, so a page its server sandboxes, whose own origin is null, was still sent the new active address on an address switch although all its requests are refused. The background now names the origin it judged by on each accountsChanged event, and the content script passes the address to the page only when the page's own window.origin is that origin, an empty list otherwise. An event naming no origin also reaches the page as an empty list. chainChanged is unchanged. The README's SiteApproval section says the same. Judgement call: covered by a unit test that sets window.origin; no browser-suite test. Model: opus-5-5
72 lines
2.5 KiB
JavaScript
72 lines
2.5 KiB
JavaScript
// AutistMask content script — bridges between inpage (window.ethereum)
|
|
// and the background service worker via extension messaging.
|
|
|
|
const {
|
|
hasBrowserNamespace,
|
|
runtimeApi,
|
|
sendMessage,
|
|
} = require("../shared/browserApi");
|
|
|
|
// In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
|
|
// in the manifest, so no injection is needed here. In Firefox (MV2), the
|
|
// "world" key is not supported, so we inject via a <script> tag.
|
|
if (hasBrowserNamespace()) {
|
|
const script = document.createElement("script");
|
|
script.src = runtimeApi().getURL("src/content/inpage.js");
|
|
script.onload = function () {
|
|
this.remove();
|
|
};
|
|
(document.head || document.documentElement).appendChild(script);
|
|
}
|
|
|
|
// Relay requests from the page to the background script
|
|
window.addEventListener("message", (event) => {
|
|
if (event.source !== window) return;
|
|
if (event.data?.type !== "AUTISTMASK_REQUEST") return;
|
|
const { id, method, params } = event.data;
|
|
|
|
sendMessage({
|
|
type: "AUTISTMASK_RPC",
|
|
id,
|
|
method,
|
|
params,
|
|
})
|
|
.then((response) => {
|
|
if (response) {
|
|
window.postMessage(
|
|
{ type: "AUTISTMASK_RESPONSE", id, ...response },
|
|
"*",
|
|
);
|
|
}
|
|
})
|
|
.catch(() => {
|
|
// No receiver: the background context is gone. The page's promise
|
|
// stays pending, which is what it did before this was a promise
|
|
// at all; turning it into a rejection here is a change to what
|
|
// dApps see and belongs to its own issue.
|
|
});
|
|
});
|
|
|
|
// Listen for events pushed from the background (e.g. accountsChanged)
|
|
runtimeApi().onMessage.addListener((msg) => {
|
|
if (msg.type !== "AUTISTMASK_EVENT") return;
|
|
// The background chooses the addresses in accountsChanged for the site
|
|
// at the origin the event names, which is the origin of the tab's URL.
|
|
// This page hears them only when its own origin is that one. A page whose
|
|
// origin has no host is not a site: one its server sandboxes with a
|
|
// Content-Security-Policy has the origin "null" whatever its URL, and is
|
|
// told no address, as its requests are refused.
|
|
let data = msg.data;
|
|
if (msg.eventName === "accountsChanged" && msg.origin !== window.origin) {
|
|
data = [];
|
|
}
|
|
window.postMessage(
|
|
{
|
|
type: "AUTISTMASK_EVENT",
|
|
eventName: msg.eventName,
|
|
data,
|
|
},
|
|
"*",
|
|
);
|
|
});
|