prehistoric-systems/keepassxc-browser
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc-browser.git synced 2026-03-11 08:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Handle iframe URLs correctly (#2166)

Browse source 
Handle iframe URLs correctly
This commit is contained in:
Sami Vänttinen 2024-06-22 12:20:33 +03:00 committed by GitHub
parent be74ac2474
commit 917e2d8f1a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
keepassxc-browser/background/page.js
View file

@ -340,7 +340,7 @@ page.setAllowIframes = async function(tab, args = []) {
const [ allowIframes, site ] = args;
// Only set when main windows' URL is used
if (tab?.url === site) {
if (trimURL(tab?.url) === trimURL(site)) {
page.tabs[tab.id].allowIframes = allowIframes;
}
};

15
keepassxc-browser/content/keepassxc-browser.js
View file

@ -33,7 +33,13 @@ kpxc.url = null;
// Add page to Site Preferences with a selected option enabled. Set from the popup.
kpxc.addToSitePreferences = async function(optionName, addWildcard = false) {
// Returns a predefined URL for certain sites
let site = trimURL(window.top.location.href).toLowerCase();
let site;
try {
site = trimURL(window.top.location.href);
} catch (err) {
logDebug('Adding to Site Preferences denied from iframe.');
return;
}
// Check if the site already exists -> update the current settings
let siteExists = false;
@ -718,11 +724,12 @@ kpxc.siteIgnored = async function(condition) {
if (kpxc.settings.sitePreferences) {
let currentLocation;
try {
currentLocation = window.top.location.href.toLowerCase();
currentLocation = window.top.location.href;
} catch (err) {
// Cross-domain security error inspecting window.top.location.href.
// This catches an error when an iframe is being accessed from another (sub)domain -> use the iframe URL instead.
currentLocation = window.self.location.href.toLowerCase();
// This catches an error when an iframe is being accessed from another (sub)domain
// -> use the iframe URL instead.
currentLocation = window.self.location.href;
}
// Refresh current settings for the site