RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge c4268bd97c into a3259400a3

This commit is contained in:
Mike Ilog 2026-07-14 19:16:50 -07:00 committed by GitHub
parent a3259400a3 c4268bd97c
commit d20a3fe12e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
extension/background.js
View File

@ -299,7 +299,13 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
}
if (msg.type === 'getPort') {
sendResponse({ port: serverPort, connected: isConnected, token: authToken });
// Withhold the auth token from content-script callers (content scripts have
// sender.tab set), mirroring the getToken guard below. port/connected stay
// available to any extension context, but the localhost auth token is never
// handed to an injected page context — without this guard getPort leaks the
// exact token getToken is careful to protect.
const token = sender.tab ? null : authToken;
sendResponse({ port: serverPort, connected: isConnected, token });
return true;
}