content script domain validation

GetScatter · Jun 20, 2018 · 06f3ab0 · 06f3ab0
1 parent 0acb9be
commit 06f3ab0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/content.js b/src/content.js
@@ -76,6 +76,13 @@ class Content {
             return;
         }
 
+        const domain = location.host.replace('www', '');
+        if(msg.hasOwnProperty('domain') && msg.domain !== domain) throw new Error('Bad domain');
+        if(msg.hasOwnProperty('payload') && msg.payload.hasOwnProperty('domain') && msg.payload.domain !== domain)
+            throw new Error('Bad domain');
+
+        console.log(msg);
+
         let nonSyncMessage = NetworkMessage.fromJson(msg);
         switch(msg.type){
             case 'sync': this.sync(msg); break;