Enforce Site Isolation

src/background.ts

@@ -6,6 +6,7 @@ import "content-scripts-register-polyfill";
 import { sendRealRequestToCustomServer, setupBackgroundRequestProxy } from "./maze-utils/background-request-proxy";
 import { setupTabUpdates } from "./maze-utils/tab-updates";
 import { generateUserID } from "./maze-utils/setup";
+import { isFirefoxOrSafari } from "./maze-utils/";
 
 // Make the config public for debugging purposes
 
@@ -31,6 +32,20 @@ utils.wait(() => Config.config !== null).then(function() {
 setupBackgroundRequestProxy();
 setupTabUpdates(Config);
 
+function isUnsafe(sender) {
+ // Only trust messages from extension pages.
+ // https://chromium.googlesource.com/chromium/src/+/master/docs/security/compromised-renderers.md#Messaging
+ if (sender.origin) {
+ if (sender.origin === location.origin) return false;
+ console.warn(`Unsafe message from: ${sender.origin} via MessageSender.origin`);
+ } else if (sender.url && isFirefoxOrSafari()) {
+ const senderOrigin = new URL(sender.url).origin;
+ if (senderOrigin === location.origin) return false;
+ console.warn(`Unsafe message from: ${senderOrigin} via MessageSender.url`);
+ }
+ return true;
+}
+
 chrome.runtime.onMessage.addListener(function (request, sender, callback) {
  switch(request.message) {
  case "openConfig":
@@ -48,12 +63,15 @@ chrome.runtime.onMessage.addListener(function (request, sender, callback) {
  //this allows the callback to be called later
  return true;
  case "registerContentScript":
- registerFirefoxContentScript(request);
+ if (isUnsafe(sender)) return false;
+ utils.setupExtraSiteContentScripts();
  return false;
  case "unregisterContentScript":
+ if (isUnsafe(sender)) return false;
  unregisterFirefoxContentScript(request.id)
  return false;
  case "tabs": {
+ if (isUnsafe(sender)) return false;
  chrome.tabs.query({
  active: true,
  currentWindow: true
@@ -205,4 +223,4 @@ async function asyncRequestToServer(type: string, address: string, data = {}) {
  const serverAddress = Config.config.testingServer ? CompileConfig.testingServerAddress : Config.config.serverAddress;
 
  return await (sendRealRequestToCustomServer(type, serverAddress + address, data));
-}
+}

src/popup.ts

@@ -69,7 +69,7 @@ class MessageHandler {
 let allowPopup = window === window.top;
 window.addEventListener("message", async (e): Promise<void> => {
  if (e.source !== window.parent) return;
- if (e.origin.endsWith('.youtube.com')) {
+ if (e.origin.startsWith('https://') && e.origin.endsWith('.youtube.com')) {
  allowPopup = true;
  }
 });

src/utils.ts

@@ -94,7 +94,7 @@ export default class Utils {
  if (this.backgroundScriptContainer) {
  this.backgroundScriptContainer.registerFirefoxContentScript(registration);
  } else {
- chrome.runtime.sendMessage(registration);
+ chrome.runtime.sendMessage({message: "registerContentScript"});
  }
  }