mirror of https://github.com/garrytan/gstack.git
c4268bd97c
The getPort message handler returned the localhost auth token to every caller, including content scripts, while the sibling getToken handler deliberately rejects content-script contexts (sender.tab is set for content scripts). A content script injected into a page could therefore obtain the token getToken is careful to protect. Apply the same sender.tab guard to getPort: port and connected stay available to any extension context, but the auth token is withheld from content-script callers. Mirrors the existing getToken behavior; no other behavior changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| icons | ||
| background.js | ||
| content.css | ||
| content.js | ||
| inspector.css | ||
| inspector.js | ||
| manifest.json | ||
| popup.html | ||
| popup.js | ||
| sidepanel-terminal.js | ||
| sidepanel.css | ||
| sidepanel.html | ||
| sidepanel.js | ||