a0473016f16e
restrict COPY to trusted extension pages and bump v5.0.77
- time
- 2026-09-03 22:49 UTC · 1 month ago
- machine
- koh2
- agent
- claude-sonnet-4-6
- session
- PB-26-309 clipboard boundary
- parent
- d0a3b01669b4
↓ peach-browser-a0473016.tar.gzatlas at this save
files changed5 files
manifest.firefox.json+1 −1manifest.json+1 −1package.json+1 −1src/background/message-policy.test.ts+21 −0src/background/message-policy.ts+1 −1manifest.firefox.json+1 −1
@@ -1,7 +1,7 @@11 {22 "manifest_version": 3,33 "name": "Peach Password Manager",4- "version": "5.0.76",4+ "version": "5.0.77",55 "description": "Zero-knowledge password manager",66 "browser_specific_settings": {77 "gecko": {manifest.json+1 −1
@@ -2,7 +2,7 @@22 "manifest_version": 3,33 "minimum_chrome_version": "116",44 "name": "Peach Password Manager",5- "version": "5.0.76",5+ "version": "5.0.77",66 "description": "Zero-knowledge password manager",77 "action": {88 "default_popup": "src/popup/index.html",package.json+1 −1
@@ -1,6 +1,6 @@11 {22 "name": "peach",3- "version": "5.0.76",3+ "version": "5.0.77",44 "description": "Zero-knowledge password manager",55 "license": "GPL-3.0-only",66 "type": "module",src/background/message-policy.test.ts+21 −0
@@ -74,6 +74,27 @@7474 }7575 });7676 77+ it("allows COPY from popup pages but rejects page-adjacent senders", () => {78+ const extensionOrigin = "chrome-extension://peach-extension/";79+ expect(getMessageContext("COPY")).toBe("extension-page-only");80+ expect(81+ isMessageSenderAllowed(82+ "COPY",83+ { id: "peach-extension", url: `${extensionOrigin}popup.html` },84+ "peach-extension",85+ extensionOrigin,86+ ),87+ ).toBe(true);88+ expect(89+ isMessageSenderAllowed(90+ "COPY",91+ { id: "peach-extension", url: "https://example.test/login" },92+ "peach-extension",93+ extensionOrigin,94+ ),95+ ).toBe(false);96+ });97+7798 it("keeps the global identity inventory extension-page-only", () => {7899 expect(getMessageContext("GET_IDENTITIES")).toBe("extension-page-only");79100 src/background/message-policy.ts+1 −1
@@ -104,7 +104,7 @@104104 ADD_ADDITIONAL_URL: "content-script-allowed",105105 REQUEST_REMEMBER_SITE: "content-script-allowed",106106 AUTOFILL_QUERY: "content-script-allowed",107- COPY: "content-script-allowed",107+ COPY: "extension-page-only",108108 FIRE_CANARY_PING: "content-script-allowed",109109 GET_ENTRY_FOR_FILL: "content-script-allowed",110110 GET_ENTRY_FOR_EDIT: "extension-page-only",