74c52ffb68e6
fix: reject URL-less privileged message senders (PB-26-115, v5.0.34)
- time
- 2026-09-01 20:40 UTC · 1 month ago
- machine
- koh2
- agent
- gpt-5
- session
- 2026-09-01 security assessment remediation
- parent
- 44585ddffc10
↓ peach-browser-74c52ffb.tar.gzatlas at this save
files changed5 files
manifest.firefox.json+1 −1manifest.json+1 −1package.json+1 −1src/background/message-policy.test.ts+11 −0src/background/message-policy.ts+1 −1manifest.firefox.json+1 −1
@@ -1,7 +1,7 @@11 {22 "manifest_version": 3,33 "name": "Peach Password Manager",4- "version": "5.0.33",4+ "version": "5.0.34",55 "description": "Zero-knowledge password manager",66 "browser_specific_settings": {77 "gecko": {manifest.json+1 −1
@@ -2,7 +2,7 @@22 "manifest_version": 3,33 "minimum_chrome_version": "116",44 "name": "Peach Password Manager",5- "version": "5.0.33",5+ "version": "5.0.34",66 "description": "Zero-knowledge password manager",77 "action": {88 "default_popup": "src/popup/index.html",package.json+1 −1
@@ -1,6 +1,6 @@11 {22 "name": "peach",3- "version": "5.0.33",3+ "version": "5.0.34",44 "description": "Zero-knowledge password manager",55 "license": "GPL-3.0-only",66 "type": "module",src/background/message-policy.test.ts+11 −0
@@ -48,6 +48,17 @@4848 expect(getMessageContext(undefined)).toBeUndefined();4949 });5050 51+ it("refuses URL-less senders for privileged extension-page messages", () => {52+ expect(53+ isMessageSenderAllowed(54+ "GET_ENTRIES",55+ { id: "peach-extension" },56+ "peach-extension",57+ "chrome-extension://peach-extension/",58+ ),59+ ).toBe(false);60+ });61+5162 it("marks the bulk vault and device-authority handlers extension-page-only", () => {5263 for (const type of [5364 "GET_ENTRIES",src/background/message-policy.ts+1 −1
@@ -165,7 +165,7 @@165165 if (context === "background-internal" || context === undefined) return false;166166 167167 if (context === "extension-page-only") {168- if (!sender.url) return true;168+ if (!sender.url) return false;169169 try {170170 return new URL(sender.url).origin === new URL(extensionOrigin).origin;171171 } catch {