prehistoric-systems/keepassxc-browser
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc-browser.git synced 2026-03-11 08:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2059 from keepassxreboot/fix/disallow_iframes_from_another_domain

Browse source 
Disallow iframes from another domain
This commit is contained in:
Sami Vänttinen 2023-12-28 16:24:11 +02:00 committed by GitHub
commit 57ac4b83b5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
keepassxc-browser/content/keepassxc-browser.js
View file

@ -580,11 +580,17 @@ kpxc.rememberCredentialsFromContextMenu = async function() {
// The basic function for retrieving credentials from KeePassXC.
// Credential Banner can force the retrieval for reloading new/modified credentials.
kpxc.retrieveCredentials = async function(force = false) {
if (!isIframeAllowed()) {
return [];
}
kpxc.url = document.location.href;
kpxc.submitUrl = kpxc.getFormActionUrl(kpxc.combinations[0]);
if (kpxc.settings.autoRetrieveCredentials && kpxc.url && kpxc.submitUrl) {
await kpxc.retrieveCredentialsCallback(await sendMessage('retrieve_credentials', [ kpxc.url, kpxc.submitUrl, force ]));
await kpxc.retrieveCredentialsCallback(
await sendMessage('retrieve_credentials', [ kpxc.url, kpxc.submitUrl, force ]),
);
}
};
@ -613,11 +619,7 @@ kpxc.retrieveCredentialsCallback = async function(credentials) {
// If credentials are not received, request them again
kpxc.receiveCredentialsIfNecessary = async function() {
if (kpxc.credentials.length === 0 && !_called.retrieveCredentials) {
// Check for Cross-domain security error when inspecting window.top.location.href. We should ignore these requests.
try {
const currentLocation = window.top.location.href;
} catch (err) {
logDebug('Error: Credential request ignored from another domain: ', window.self.location.host);
if (!isIframeAllowed()) {
return [];
}
@ -632,7 +634,8 @@ kpxc.receiveCredentialsIfNecessary = async function() {
return [];
}
// If the database was locked, this is scope never met. In these cases the response is met at kpxc.detectDatabaseChange
// If the database was locked, this is scope never met.
// In these cases the response is met at kpxc.detectDatabaseChange
await sendMessage('page_set_manual_fill', ManualFill.NONE);
await kpxc.retrieveCredentialsCallback(credentials);
@ -964,3 +967,14 @@ kpxc.reconnect = async function() {
}
return true;
};
// Check for Cross-domain security error when inspecting window.top.location.href
const isIframeAllowed = function() {
try {
const currentLocation = window.top.location.href;
return true;
} catch (err) {
logDebug(`Error: Credential request ignored from another domain: ${window.self.location.host}`);
return false;
}
};