64b75c5bf4
window.bitcoincash was gated on a ".x" hostname in both the preload and the host handlers — inherited from the pre-multi-wallet build, when every dapp Aegis knew about was a Silent Mode one. It was never a security boundary: the TRX / ETH / SOL bridges have always injected everywhere, and every BCH call still crosses into main, raises an approval overlay and honours per-origin permissions. The preload cannot read an address or sign anything by itself. What the gate actually cost was Cauldron, bch.guru and our own dapps on other TLDs (potidaea.asm) seeing no BCH provider at all, on a wallet whose entire subject is BCH. WizardConnect was never gated this way, so the two halves of the same bridge disagreed about who could talk to it. isBchOrigin becomes isDappOrigin and now only keeps non-web schemes out — file://, chrome://, data:, javascript: and anything unparseable. Separately: page-inject declared https://*/* only, so a dapp served from http://127.0.0.1 got no preload at all, which is a different cause from the .x gate and would have survived removing it. localhost, 127.0.0.1 and [::1] are now matched over http as well (the host's compiler makes the port optional, so :3000 and :5173 are covered). Plain http on any other host stays out, since an http page is tamperable in transit and only local development needs the exception.
32 lines
1.2 KiB
JSON
32 lines
1.2 KiB
JSON
{
|
|
"id": "aegis",
|
|
"name": "Aegis Wallet",
|
|
"version": "0.27.0",
|
|
"category": "plugin",
|
|
"description": "Multi-chain wallet (BCH, BTC, TRX, ETH, SOL, SC, DGB) derived from your Theseus vault. Dapps get window.bitcoincash and window.wizardconnect on any site; window.tronWeb / window.tronLink / window.ethereum / window.solana too. Every call needs your approval.",
|
|
"author": "Silent Mode",
|
|
"icon": "data:image/svg+xml;utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32' fill='none'%3E%3Cpolygon points='16,2 28,9 28,23 16,30 4,23 4,9' fill='%230a0a0d' stroke='%23D6FF3D' stroke-width='1.6' stroke-linejoin='round'/%3E%3Ccircle cx='16' cy='16' r='4.5' fill='none' stroke='%23D6FF3D' stroke-width='1.4'/%3E%3Ccircle cx='16' cy='16' r='1.6' fill='%23D6FF3D'/%3E%3C/svg%3E",
|
|
"main": "index.js",
|
|
"updateURL": "https://navigate.st/bns/theseus.x/extensions/aegis/updates.json",
|
|
"capabilities": [
|
|
"sidebar-panel",
|
|
"vault-derive",
|
|
"page-inject",
|
|
"approval-modal",
|
|
"scan-page",
|
|
"open-tab"
|
|
],
|
|
"absorbs": [
|
|
"bchwallet",
|
|
"siawallet"
|
|
],
|
|
"page-inject": {
|
|
"preload": "wallet-inject.js",
|
|
"origins": [
|
|
"https://*/*",
|
|
"http://localhost/*",
|
|
"http://127.0.0.1/*",
|
|
"http://[::1]/*"
|
|
]
|
|
}
|
|
}
|