RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(extension): withhold auth token from content-script getPort callers 

The getPort message handler returned the localhost auth token to every
caller, including content scripts, while the sibling getToken handler
deliberately rejects content-script contexts (sender.tab is set for
content scripts). A content script injected into a page could therefore
obtain the token getToken is careful to protect.

Apply the same sender.tab guard to getPort: port and connected stay
available to any extension context, but the auth token is withheld from
content-script callers. Mirrors the existing getToken behavior; no other
behavior changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mike Ilog 2026-05-31 15:45:51 -07:00
parent 3bef43bc5a
commit c4268bd97c
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
extension/background.js
View File

@ -299,7 +299,13 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
}
if (msg.type === 'getPort') {
sendResponse({ port: serverPort, connected: isConnected, token: authToken });
// Withhold the auth token from content-script callers (content scripts have
// sender.tab set), mirroring the getToken guard below. port/connected stay
// available to any extension context, but the localhost auth token is never
// handed to an injected page context — without this guard getPort leaks the
// exact token getToken is careful to protect.
const token = sender.tab ? null : authToken;
sendResponse({ port: serverPort, connected: isConnected, token });
return true;
}