fix: Enforce distinct authorization for HTTP and HTTPS origins (#1555)

* fix: url handling in State to distinguish http/https origins

* fix: tests

* chore: parse URL in a better way

packages/extension-base/src/background/handlers/State.ts

@@ -377,11 +377,24 @@ export default class State {
   };
 
   public stripUrl (url: string): string {
-    assert(url && (url.startsWith('http:') || url.startsWith('https:') || url.startsWith('ipfs:') || url.startsWith('ipns:')), `Invalid url ${url}, expected to start with http: or https: or ipfs: or ipns:`);
+    try {
+      const parsedUrl = new URL(url);
 
-    const parts = url.split('/');
+      if (!['http:', 'https:', 'ipfs:', 'ipns:'].includes(parsedUrl.protocol)) {
+        throw new Error(`Invalid protocol ${parsedUrl.protocol}`);
+      }
 
-    return parts[2];
+      // For ipfs/ipns which don't have a standard origin, we handle it differently.
+      if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {
+        // ipfs://<hash> | ipns://<hash>
+        return `${parsedUrl.protocol}//${parsedUrl.hostname}`;
+      }
+
+      return parsedUrl.origin;
+    } catch (e) {
+      console.error(e);
+      throw new Error('Invalid URL');
+    }
   }
 
   private updateIcon (shouldClose?: boolean): void {

packages/extension-mocks/src/chrome.ts

@@ -33,7 +33,7 @@ chrome.storage.local.get.returns(
     try {
       const result = {
         authUrls: JSON.stringify({
-          'localhost:3000': {
+          'http://localhost:3000': {
             authorizedAccounts: ['5FbSap4BsWfjyRhCchoVdZHkDnmDm3NEgLZ25mesq4aw2WvX'],
             count: 0,
             id: '11',