From 7f06f4a260cb5b606001c7a1ea2e6f78e04f704c Mon Sep 17 00:00:00 2001 From: Remon Nashid Date: Tue, 20 Apr 2021 06:14:02 -0700 Subject: [PATCH] Prevent unauthorized apps from abusing pub(authorize.tab) request (#686) --- packages/extension-base/src/background/handlers/State.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/extension-base/src/background/handlers/State.ts b/packages/extension-base/src/background/handlers/State.ts index f813399d..e131d621 100644 --- a/packages/extension-base/src/background/handlers/State.ts +++ b/packages/extension-base/src/background/handlers/State.ts @@ -295,6 +295,12 @@ export default class State { public async authorizeUrl (url: string, request: RequestAuthorizeTab): Promise { const idStr = this.stripUrl(url); + // Do not enqueue duplicate authorization requests. + const isDuplicate = Object.values(this.#authRequests) + .some((request) => request.idStr === idStr); + + assert(!isDuplicate, `The source ${url} has a pending authorization request`); + if (this.#authUrls[idStr]) { // this url was seen in the past assert(this.#authUrls[idStr].isAllowed, `The source ${url} is not allowed to interact with this extension`);