Enforce Site Isolation

src/background.ts

@@ -6,6 +6,7 @@ import "content-scripts-register-polyfill";
 import { sendRealRequestToCustomServer, setupBackgroundRequestProxy } from "./maze-utils/background-request-proxy";
 import { setupTabUpdates } from "./maze-utils/tab-updates";
 import { generateUserID } from "./maze-utils/setup";
+import { isFirefoxOrSafari } from "./maze-utils/";
 
 // Make the config public for debugging purposes
 
@@ -31,6 +32,20 @@ utils.wait(() => Config.config !== null).then(function() {
 setupBackgroundRequestProxy();
 setupTabUpdates(Config);
 
+function isUnsafe(sender)  {
+    // Only trust messages from extension pages.
+    // https://chromium.googlesource.com/chromium/src/+/master/docs/security/compromised-renderers.md#Messaging
+    if (sender.origin) {
+        if (sender.origin === location.origin) return false;
+        console.warn(`Unsafe message from: ${sender.origin} via MessageSender.origin`);
+    } else if (sender.url && isFirefoxOrSafari()) {
+        const senderOrigin = new URL(sender.url).origin;
+        if (senderOrigin === location.origin) return false;
+        console.warn(`Unsafe message from: ${senderOrigin} via MessageSender.url`);
+    }
+    return true;
+}
+
 chrome.runtime.onMessage.addListener(function (request, sender, callback) {
     switch(request.message) {
         case "openConfig":
@@ -48,12 +63,15 @@ chrome.runtime.onMessage.addListener(function (request, sender, callback) {
             //this allows the callback to be called later
             return true;
         case "registerContentScript":
-            registerFirefoxContentScript(request);
+            if (isUnsafe(sender)) return false;
+            utils.setupExtraSiteContentScripts();
             return false;
         case "unregisterContentScript":
+            if (isUnsafe(sender)) return false;
             unregisterFirefoxContentScript(request.id)
             return false;
         case "tabs": {
+            if (isUnsafe(sender)) return false;
             chrome.tabs.query({
                 active: true,
                 currentWindow: true
@@ -205,4 +223,4 @@ async function asyncRequestToServer(type: string, address: string, data = {}) {
     const serverAddress = Config.config.testingServer ? CompileConfig.testingServerAddress : Config.config.serverAddress;
 
     return await (sendRealRequestToCustomServer(type, serverAddress + address, data));
-}
+}

src/popup.ts

@@ -69,7 +69,7 @@ class MessageHandler {
 let allowPopup = window === window.top;
 window.addEventListener("message", async (e): Promise<void> => {
     if (e.source !== window.parent) return;
-    if (e.origin.endsWith('.youtube.com')) {
+    if (e.origin.startsWith('https://') && e.origin.endsWith('.youtube.com')) {
         allowPopup = true;
     }
 });

src/utils.ts

@@ -94,7 +94,7 @@ export default class Utils {
         if (this.backgroundScriptContainer) {
             this.backgroundScriptContainer.registerFirefoxContentScript(registration);
         } else {
-            chrome.runtime.sendMessage(registration);
+            chrome.runtime.sendMessage({message: "registerContentScript"});
         }
     }