add Firefox Docker content-script session-storage isolation evidence

@@ -235,12 +235,14 @@235235             send({ type: "GET_SETTINGS" }),236236             send({ type: "GET_ENTRIES" }),237237             send({ type: "GET_RECOVERY_WORDS" }),238-          ]).then(([allowed, entries, recovery]) => done({238+            send({ type: "STORAGE_SESSION" }),239+          ]).then(([allowed, entries, recovery, storage]) => done({239240             pageOrigin: location.origin,240241             probeReady: document.documentElement.dataset.peachFirefoxSenderProbe ?? null,241242             allowed,242243             entries,243244             recovery,245+            storage,244246           }));245247         `,246248         args: [],@@ -252,6 +254,9 @@252254     }253255     if (result.probeReady !== "ready") {254256       throw new Error(`Firefox content-script probe did not execute: ${JSON.stringify(result)}`);257+    }258+    if (Object.prototype.hasOwnProperty.call(result.storage ?? {}, "peach_session_dk")) {259+      throw new Error(`Firefox content-script accessed the session escrow key: ${JSON.stringify(result.storage)}`);255260     }256261     if (result.allowed?.error === "invalid_sender") {257262       throw new Error("Content-script-allowed GET_SETTINGS was rejected");

@@ -11,11 +11,16 @@1111       return;1212     }1313     const { id, message } = request ?? {};14-    if (request?.source !== SOURCE || typeof id !== "string" || !message || !ALLOWED_TYPES.has(message.type)) return;14+    if (request?.source !== SOURCE || typeof id !== "string" || !message) return;1515 1616     let response;1717     try {18-      response = await chrome.runtime.sendMessage(message);18+      response = message.type === "STORAGE_SESSION"19+        ? await chrome.storage.session.get("peach_session_dk")20+        : ALLOWED_TYPES.has(message.type)21+          ? await chrome.runtime.sendMessage(message)22+          : undefined;23+      if (response === undefined) return;1924     } catch (error) {2025       response = { ok: false, error: String(error) };2126     }