From 1c53c11bf583540ed49a1d54cc82e8ca1d4ae2f8 Mon Sep 17 00:00:00 2001
From: rajk93 <raj@blockdeep.io>
Date: Fri, 13 Jun 2025 18:43:45 +0530
Subject: [PATCH] fix: Enforce distinct authorization for HTTP and HTTPS
 origins (#1555)

* fix: url handling in State to distinguish http/https origins

* fix: tests

* chore: parse URL in a better way
---
 .../src/background/handlers/State.ts          | 19 ++++++++++++++++---
 packages/extension-mocks/src/chrome.ts        |  2 +-
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/packages/extension-base/src/background/handlers/State.ts b/packages/extension-base/src/background/handlers/State.ts
index f01221d6..8963fa49 100644
--- a/packages/extension-base/src/background/handlers/State.ts
+++ b/packages/extension-base/src/background/handlers/State.ts
@@ -377,11 +377,24 @@ export default class State {
   };
 
   public stripUrl (url: string): string {
-    assert(url && (url.startsWith('http:') || url.startsWith('https:') || url.startsWith('ipfs:') || url.startsWith('ipns:')), `Invalid url ${url}, expected to start with http: or https: or ipfs: or ipns:`);
+    try {
+      const parsedUrl = new URL(url);
 
-    const parts = url.split('/');
+      if (!['http:', 'https:', 'ipfs:', 'ipns:'].includes(parsedUrl.protocol)) {
+        throw new Error(`Invalid protocol ${parsedUrl.protocol}`);
+      }
 
-    return parts[2];
+      // For ipfs/ipns which don't have a standard origin, we handle it differently.
+      if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {
+        // ipfs://<hash> | ipns://<hash>
+        return `${parsedUrl.protocol}//${parsedUrl.hostname}`;
+      }
+
+      return parsedUrl.origin;
+    } catch (e) {
+      console.error(e);
+      throw new Error('Invalid URL');
+    }
   }
 
   private updateIcon (shouldClose?: boolean): void {
diff --git a/packages/extension-mocks/src/chrome.ts b/packages/extension-mocks/src/chrome.ts
index d847081a..78cba048 100644
--- a/packages/extension-mocks/src/chrome.ts
+++ b/packages/extension-mocks/src/chrome.ts
@@ -33,7 +33,7 @@ chrome.storage.local.get.returns(
     try {
       const result = {
         authUrls: JSON.stringify({
-          'localhost:3000': {
+          'http://localhost:3000': {
             authorizedAccounts: ['5FbSap4BsWfjyRhCchoVdZHkDnmDm3NEgLZ25mesq4aw2WvX'],
             count: 0,
             id: '11',