From e1a0bd2db89de15d179deb41cecf99ec3ebbe634 Mon Sep 17 00:00:00 2001
From: Axel Chalon <xaxel@protonmail.com>
Date: Fri, 19 Jul 2019 20:28:18 +0200
Subject: [PATCH] Extension: reject requests from unauthorized urls (#101)

---
 packages/extension/src/background/handlers/State.ts | 2 +-
 packages/extension/src/background/handlers/Tabs.ts  | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/extension/src/background/handlers/State.ts b/packages/extension/src/background/handlers/State.ts
index 4db9ebc3..118f0ed6 100644
--- a/packages/extension/src/background/handlers/State.ts
+++ b/packages/extension/src/background/handlers/State.ts
@@ -193,7 +193,7 @@ export default class State {
     });
   }
 
-  public isUrlAuthorized (url: string): boolean {
+  public ensureUrlAuthorized (url: string): boolean {
     const entry = this._authUrls[this.stripUrl(url)];
 
     assert(entry, `The source ${url} has not been enabled yet`);
diff --git a/packages/extension/src/background/handlers/Tabs.ts b/packages/extension/src/background/handlers/Tabs.ts
index a9480cac..103d6316 100644
--- a/packages/extension/src/background/handlers/Tabs.ts
+++ b/packages/extension/src/background/handlers/Tabs.ts
@@ -66,6 +66,10 @@ export default class Tabs {
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   public async handle (id: string, type: MessageTypes, request: any, url: string, port: chrome.runtime.Port): Promise<any> {
+    if (type !== 'authorize.tab') {
+      this.state.ensureUrlAuthorized(url);
+    }
+
     switch (type) {
       case 'authorize.tab':
         return this.authorize(url, request);