Prevent unauthorized apps from abusing pub(authorize.tab) request (#686)

2021-04-20 15:14:02 +02:00
parent 93cb15b310
commit 7f06f4a260
1 changed files with 6 additions and 0 deletions
@@ -295,6 +295,12 @@ export default class State {
  public async authorizeUrl (url: string, request: RequestAuthorizeTab): Promise<boolean> {
    const idStr = this.stripUrl(url);

+    // Do not enqueue duplicate authorization requests.
+    const isDuplicate = Object.values(this.#authRequests)
+      .some((request) => request.idStr === idStr);
+
+    assert(!isDuplicate, `The source ${url} has a pending authorization request`);
+
    if (this.#authUrls[idStr]) {
      // this url was seen in the past
      assert(this.#authUrls[idStr].isAllowed, `The source ${url} is not allowed to interact with this extension`);