mirror of
https://github.com/mmis1000/SofaNav.git
synced 2026-10-17 15:01:05 +02:00
mmis1000andClaude Opus 5.5
956d34e90c
External audit (ChatGPT, commit7650661): the frame client trusted postMessage from its parent, but a page that embeds another site is its parent. A malicious page could fetch element ids and send "activate", clicking inside the embedded site with no user input (its cookies and CSRF token included). Reproduced with the real extension and as a page script: an invisible victim frame's form was submitted 22 times. - Extension: commands and replies go through extension messaging, relayed by the background script with browser-provided tab/frame ids; it only forwards commands from the tab's top frame and replies to it. postMessage only carries a random single-use probe nonce that maps an <iframe> to its frame id; forged probes are ignored. - Userscript / page script: no unforgeable channel exists, so a frame is a client only when its parent is same-origin; cross-origin frames are one plain element. - scripts/security.js (npm run test:security, also in CI): runs the attack in both setups with the real extension loaded, and checks the extension still reaches cross-origin frames (negative control: fails without the relay). Fails 2 of 3 on7650661, passes now. - Test pages: ?ext mode (rely on the installed extension), attack pages. - Docs, README, website and demo updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
19 lines
570 B
JSON
19 lines
570 B
JSON
{
|
|
"name": "sofanav",
|
|
"version": "0.3.0",
|
|
"private": true,
|
|
"description": "Console-style gamepad navigation for any web page (browser extension + userscript).",
|
|
"scripts": {
|
|
"build": "node build-userscript.js",
|
|
"serve": "python -m http.server 8765",
|
|
"demo": "node scripts/record-demo.js",
|
|
"test:regress": "node scripts/regressions.js",
|
|
"site": "node scripts/build-site.js",
|
|
"serve:site": "python -m http.server 8766 -d _site",
|
|
"test:security": "node scripts/security.js"
|
|
},
|
|
"devDependencies": {
|
|
"playwright": "^1.64.0"
|
|
}
|
|
}
|