sam_oneal/fx_cast
1
0
Fork 0
mirror of https://github.com/hensm/fx_cast.git synced 2026-06-08 08:39:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Limit incoming content messages for untrusted instances

Browse Source
This commit is contained in:
hensm
2022-09-08 20:52:52 +01:00
parent 4581ef6c92
commit 517d2768da
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ext/src/background/castManager.ts
View File

@@ -110,6 +110,13 @@ let receiverSelector: Optional<ReceiverSelector>;
const activeInstances = new Set<CastInstance>(); const activeInstances = new Set<CastInstance>();
const allowedContentMessages: Array<Message["subject"]> = [
"main:initializeCastSdk",
"main:requestSession",
"bridge:sendCastReceiverMessage",
"bridge:sendCastSessionMessage"
];
/** Keeps track of cast API instances and provides bridge messaging. */ /** Keeps track of cast API instances and provides bridge messaging. */
const castManager = new (class { const castManager = new (class {
async init() { async init() {
@@ -356,6 +363,16 @@ const castManager = new (class {
instance: CastInstance, instance: CastInstance,
message: Message message: Message
) { ) {
// Limit untrusted instances to allowed messages subset
if (
!allowedContentMessages.includes(message.subject) &&
!instance.isTrusted
) {
logger.error(`Forbidden message type! (${message.subject})`);
disconnectContentPort(instance.contentPort);
return;
}
const [destination] = message.subject.split(":"); const [destination] = message.subject.split(":");
if (destination === "bridge") { if (destination === "bridge") {
instance.bridgePort.postMessage(message); instance.bridgePort.postMessage(message);
@@ -383,6 +400,7 @@ const castManager = new (class {
logger.error( logger.error(
"Cast instance not trusted to bypass receiver selection!" "Cast instance not trusted to bypass receiver selection!"
); );
disconnectContentPort(instance.contentPort);
break; break;
} }