prehistoric-systems/keepassxc-browser
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc-browser.git synced 2026-03-11 08:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Prevent Cross-Origin requests to KeePassXC

Browse source
This commit is contained in:
varjolintu 2022-05-29 10:25:57 +03:00
parent 3ea3a26a1d
commit 961b7ecbf5
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
keepassxc-browser/content/keepassxc-browser.js
View file

@ -588,6 +588,14 @@ kpxc.retrieveCredentialsCallback = async function(credentials) {
// If credentials are not received, request them again
kpxc.receiveCredentialsIfNecessary = async function() {
if (kpxc.credentials.length === 0 && !_called.retrieveCredentials) {
// Check for Cross-domain security error when inspecting window.top.location.href. We should ignore these requests.
try {
const currentLocation = window.top.location.href;
} catch (err) {
logDebug('Error: Credential request ignored from another domain: ', window.self.location.host);
return [];
}
if (!kpxc.url) {
kpxc.url = document.location.href;
}