Commit 0ff9fb30 authored by Lukasz Anforowicz's avatar Lukasz Anforowicz Committed by Commit Bot

Use MessageSender.origin to check if sender is one of eligible clients.

When an extension message is received, we check `MessageSender.id` to
disallow requests from unknown clients.  Unfortunately,
`MessageSender.id` is currently not trustworthy (issue 982361) and
therefore this CL switches to using `MessageSender.origin` instead.

Bug: 10321587
Change-Id: I3729a407bef47e5ca4212ee3fe748b89c8d16a50
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2031526Reviewed-by: default avatarDavid Tseng <dtseng@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#737518}
parent 5a4dee22
...@@ -89,12 +89,12 @@ cvox.BrailleInputHandler = function(translatorManager) { ...@@ -89,12 +89,12 @@ cvox.BrailleInputHandler = function(translatorManager) {
}; };
/** /**
* The ID of the Braille IME extension built into Chrome OS. * The origin of the Braille IME extension built into Chrome OS.
* @const {string} * @const {string}
* @private * @private
*/ */
cvox.BrailleInputHandler.IME_EXTENSION_ID_ = cvox.BrailleInputHandler.IME_EXTENSION_ORIGIN_ =
'jddehjeebkoimngcbdkaahpobgicbffp'; 'chrome-extension://jddehjeebkoimngcbdkaahpobgicbffp';
/** /**
* Name of the port to use for communicating with the Braille IME. * Name of the port to use for communicating with the Braille IME.
...@@ -331,7 +331,7 @@ cvox.BrailleInputHandler.prototype = { ...@@ -331,7 +331,7 @@ cvox.BrailleInputHandler.prototype = {
*/ */
onImeConnect_: function(port) { onImeConnect_: function(port) {
if (port.name !== cvox.BrailleInputHandler.IME_PORT_NAME_ || if (port.name !== cvox.BrailleInputHandler.IME_PORT_NAME_ ||
port.sender.id !== cvox.BrailleInputHandler.IME_EXTENSION_ID_) { port.sender.origin !== cvox.BrailleInputHandler.IME_EXTENSION_ORIGIN_) {
return; return;
} }
if (this.imePort_) if (this.imePort_)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment