restrict post messages to origin if used

Author: jagdeep sidhu

source/scripts/ContentScript/inject/BaseProvider.ts

@@ -328,7 +328,7 @@ export class BaseProvider extends EventEmitter {
           type,
           data,
         },
-        '*'
+        window.location.origin
       );
     });
 }

trezor-usb-permissions.js

@@ -19,11 +19,21 @@
       });
       setStatus('USB permission granted. You can close this tab/window.');
       try {
-        window.opener &&
+        if (window.opener) {
+          let openerOrigin = '*';
+          try {
+            if (document.referrer) {
+              let url = new URL(document.referrer);
+              openerOrigin = url.origin;
+            }
+          } catch (_) {
+            openerOrigin = '*';
+          }
           window.opener.postMessage(
             { type: 'trezor-usb-permission-granted' },
-            '*'
+            openerOrigin
           );
+        }
       } catch (_) {}
     } catch (e) {
       setStatus(e && e.message ? e.message : 'USB permission error', true);