prehistoric-systems/keepassxc-browser
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc-browser.git synced 2026-03-11 08:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1634 from keepassxreboot/fix/prevent_cross_origin_requests

Browse source 
Prevent Cross-Origin requests to KeePassXC
This commit is contained in:
Sami Vänttinen 2022-05-29 15:58:26 +03:00 committed by GitHub
commit 9af37d688a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
keepassxc-browser/content/keepassxc-browser.js
View file

@ -588,6 +588,14 @@ kpxc.retrieveCredentialsCallback = async function(credentials) {
// If credentials are not received, request them again
kpxc.receiveCredentialsIfNecessary = async function() {
if (kpxc.credentials.length === 0 && !_called.retrieveCredentials) {
// Check for Cross-domain security error when inspecting window.top.location.href. We should ignore these requests.
try {
const currentLocation = window.top.location.href;
} catch (err) {
logDebug('Error: Credential request ignored from another domain: ', window.self.location.host);
return [];
}
if (!kpxc.url) {
kpxc.url = document.location.href;
}