f57cf4c894
The isolated-world relay accepted any postMessage carrying the fixed tag "aegis-aegis", including one from a cross-origin iframe (an ad, an embed), and attributed it to the top-level origin and its grants. The tag now carries a per-load random nonce that only the injected main-world bridge knows, and both listeners drop events whose source is not this window. The document_start install path is unchanged. |
||
|---|---|---|
| .. | ||
| lib | ||
| addon.json | ||
| electrum-servers.json | ||
| index.js | ||
| panel.html | ||
| panel.js | ||
| qr.js | ||
| wallet-inject.js | ||