From 917e2d8f1aeeabb207a8dc871ec383f6c942bb00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sami=20V=C3=A4nttinen?= <sami.vanttinen@ahmala.org>
Date: Sat, 22 Jun 2024 12:20:33 +0300
Subject: [PATCH] Handle iframe URLs correctly (#2166)

Handle iframe URLs correctly
---
 keepassxc-browser/background/page.js           |  2 +-
 keepassxc-browser/content/keepassxc-browser.js | 15 +++++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/keepassxc-browser/background/page.js b/keepassxc-browser/background/page.js
index d37a190..9ed6cc4 100755
--- a/keepassxc-browser/background/page.js
+++ b/keepassxc-browser/background/page.js
@@ -340,7 +340,7 @@ page.setAllowIframes = async function(tab, args = []) {
     const [ allowIframes, site ] = args;
 
     // Only set when main windows' URL is used
-    if (tab?.url === site) {
+    if (trimURL(tab?.url) === trimURL(site)) {
         page.tabs[tab.id].allowIframes = allowIframes;
     }
 };
diff --git a/keepassxc-browser/content/keepassxc-browser.js b/keepassxc-browser/content/keepassxc-browser.js
index 64b51f3..21dfc8d 100755
--- a/keepassxc-browser/content/keepassxc-browser.js
+++ b/keepassxc-browser/content/keepassxc-browser.js
@@ -33,7 +33,13 @@ kpxc.url = null;
 // Add page to Site Preferences with a selected option enabled. Set from the popup.
 kpxc.addToSitePreferences = async function(optionName, addWildcard = false) {
     // Returns a predefined URL for certain sites
-    let site = trimURL(window.top.location.href).toLowerCase();
+    let site;
+    try {
+        site = trimURL(window.top.location.href);
+    } catch (err) {
+        logDebug('Adding to Site Preferences denied from iframe.');
+        return;
+    }
 
     // Check if the site already exists -> update the current settings
     let siteExists = false;
@@ -718,11 +724,12 @@ kpxc.siteIgnored = async function(condition) {
     if (kpxc.settings.sitePreferences) {
         let currentLocation;
         try {
-            currentLocation = window.top.location.href.toLowerCase();
+            currentLocation = window.top.location.href;
         } catch (err) {
             // Cross-domain security error inspecting window.top.location.href.
-            // This catches an error when an iframe is being accessed from another (sub)domain -> use the iframe URL instead.
-            currentLocation = window.self.location.href.toLowerCase();
+            // This catches an error when an iframe is being accessed from another (sub)domain
+            // -> use the iframe URL instead.
+            currentLocation = window.self.location.href;
         }
 
         // Refresh current settings for the site