fix (#204)

Co-authored-by: [email protected] <[email protected]>

Author: ladamski

Sources/ContentScopeScripts/dist/contentScope.js

@@ -1428,6 +1428,11 @@
   // eslint-disable-next-line no-global-assign
   let globalObj = typeof window === 'undefined' ? globalThis : window;
   let Error$1 = globalObj.Error;
+  let messageSecret;
+
+  function registerMessageSecret (secret) {
+      messageSecret = secret;
+  }
 
   function getDataKeySync (sessionKey, domainKey, inputData) {
       // eslint-disable-next-line new-cap
@@ -1818,7 +1823,7 @@
 
   function sendMessage (messageType, options) {
       // FF & Chrome
-      return window.dispatchEvent(createCustomEvent('sendMessage', { detail: { messageType, options } }))
+      return window.dispatchEvent(createCustomEvent('sendMessage' + messageSecret, { detail: { messageType, options } }))
       // TBD other platforms
   }
 
@@ -1899,6 +1904,7 @@
       if (!shouldRun()) {
           return
       }
+      registerMessageSecret(args.messageSecret);
       initStringExemptionLists(args);
       const resolvedFeatures = await Promise.all(features);
       resolvedFeatures.forEach(({ init, featureName }) => {

build/android/contentScope.js

@@ -1,6 +1,9 @@
 /**
  * Inject all the overwrites into the page.
  */
+
+const messageSecret = randomString()
+
 function inject (code) {
     const elem = document.head || document.documentElement
     // Inject into main page
@@ -92,6 +95,7 @@ function init () {
                 }
             })
         }
+        message.messageSecret = messageSecret
         const stringifiedArgs = JSON.stringify(message)
         const callRandomFunction = `
                 window.${randomMethodName}('${randomPassword}', ${stringifiedArgs});
@@ -110,7 +114,7 @@ function init () {
         }
     })
 
-    window.addEventListener('sendMessage', (m) => {
+    window.addEventListener('sendMessage' + messageSecret, (m) => {
         const messageType = m.detail.messageType
         chrome.runtime.sendMessage(m && m.detail, response => {
             const msg = { type: messageType, response }

build/chrome-mv3/inject.js

@@ -1,5 +1,12 @@
 /* global contentScopeFeatures */
 
+const messageSecret = randomString()
+
+function randomString () {
+    const num = crypto.getRandomValues(new Uint32Array(1))[0] / 2 ** 32
+    return num.toString().replace('0.', '')
+}
+
 function init () {
     contentScopeFeatures.load({
         platform: {
@@ -28,6 +35,7 @@ function init () {
                 }
             })
         }
+        message.messageSecret = messageSecret
         contentScopeFeatures.init(message)
     })
 
@@ -38,7 +46,7 @@ function init () {
         }
     })
 
-    window.addEventListener('sendMessage', (m) => {
+    window.addEventListener('sendMessage' + messageSecret, (m) => {
         const messageType = m.detail.messageType
         chrome.runtime.sendMessage(m && m.detail, response => {
             const msg = { type: messageType, response }

build/chrome/inject.js

@@ -1,4 +1,4 @@
-import { initStringExemptionLists, isFeatureBroken } from './utils'
+import { initStringExemptionLists, isFeatureBroken, registerMessageSecret } from './utils'
 
 function shouldRun () {
     // don't inject into non-HTML documents (such as XML documents)
@@ -56,6 +56,7 @@ export async function init (args) {
     if (!shouldRun()) {
         return
     }
+    registerMessageSecret(args.messageSecret)
     initStringExemptionLists(args)
     const resolvedFeatures = await Promise.all(features)
     resolvedFeatures.forEach(({ init, featureName }) => {

build/firefox/inject.js

@@ -5,6 +5,11 @@ import { sjcl } from '../lib/sjcl.js'
 // eslint-disable-next-line no-global-assign
 let globalObj = typeof window === 'undefined' ? globalThis : window
 let Error = globalObj.Error
+let messageSecret
+
+export function registerMessageSecret (secret) {
+    messageSecret = secret
+}
 
 /**
  * Used for testing to override the globals used within this file.
@@ -501,6 +506,6 @@ export function createCustomEvent (eventName, eventDetail) {
 
 export function sendMessage (messageType, options) {
     // FF & Chrome
-    return window.dispatchEvent(createCustomEvent('sendMessage', { detail: { messageType, options } }))
+    return window.dispatchEvent(createCustomEvent('sendMessage' + messageSecret, { detail: { messageType, options } }))
     // TBD other platforms
 }