Extension: reject requests from unauthorized urls (#101)

packages/extension/src/background/handlers/State.ts

@@ -193,7 +193,7 @@ export default class State {
     });
   }
 
-  public isUrlAuthorized (url: string): boolean {
+  public ensureUrlAuthorized (url: string): boolean {
     const entry = this._authUrls[this.stripUrl(url)];
 
     assert(entry, `The source ${url} has not been enabled yet`);

packages/extension/src/background/handlers/Tabs.ts

@@ -66,6 +66,10 @@ export default class Tabs {
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   public async handle (id: string, type: MessageTypes, request: any, url: string, port: chrome.runtime.Port): Promise<any> {
+    if (type !== 'authorize.tab') {
+      this.state.ensureUrlAuthorized(url);
+    }
+
     switch (type) {
       case 'authorize.tab':
         return this.authorize(url, request);