Only allow events from certain sources

src/background/index.js

@@ -58,10 +58,36 @@ async function handleExtensionSetup() {
   }
 }
 
+/**
+ * Check if a message comes from an authorized source
+ * @param {string} url
+ * @returns {Promise<boolean>}
+ */
+const isMessageAllowed = async (url) => {
+  const requestUrl = new URL(url);
+  const apiUrl = new URL(SLStorage.DEFAULT_SETTINGS[SLStorage.SETTINGS.API_URL]);
+
+  const ALLOWED_SOURCES = [
+    new RegExp(apiUrl.hostname),
+    new RegExp("^app\\.simplelogin\\.io$"),
+    new RegExp("^.*\\.proton\\.ch$"),
+    new RegExp("^.*\\.protonmail\\.ch$"),
+    new RegExp("^.*\\.protonmail\\.com$"),
+  ];
+
+  for (const source of ALLOWED_SOURCES) {
+    if (source.test(requestUrl.host)) return true;
+  }
+  return false;
+};
+
 /**
  * Register onMessage listener
  */
 browser.runtime.onMessage.addListener(async function (request, sender) {
+  const isAllowed = await isMessageAllowed(sender.url);
+  if (!isAllowed) return;
+
   if (request.tag === "NEW_RANDOM_ALIAS") {
     return await handleNewRandomAlias(request.currentUrl);
   } else if (request.tag === "GET_APP_SETTINGS") {

src/content_script/input_tools.js

@@ -249,7 +249,8 @@ if (!window._hasExecutedSlExtension) {
        */
       const onEvent = async (event) => {
         if (event.source !== window) return;
-        if (event.data.tag && (event.data.tag === "PERFORM_EXTENSION_SETUP")) {
+        if (!event.data.tag) return;
+        if (event.data.tag === "PERFORM_EXTENSION_SETUP") {
           await sendMessageToBackground("EXTENSION_SETUP");
         }
       };