Fix bugs and harden against XSS across the extension

.github/workflows/test.yml

@@ -37,6 +37,9 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
+      - name: Build Extension
+        run: npm run build:chrome
+
       - uses: nick-fields/retry@v3
         name: Run Test
         with:
@@ -59,6 +62,9 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
+      - name: Build Extension
+        run: npm run build:chrome
+
       - uses: nick-fields/retry@v3
         name: Run Storage Test
         with:

src/background/background.js

@@ -87,7 +87,9 @@ export function initBackground() {
     // Remove DOM-dependent setFaviconCode since it's not needed in service worker
 
     const fetchOpenReviewNoteJSON = async (url) => {
-        const id = url.match(/id=([\w-])+/)[0].replace("id=", "");
+        const match = url.match(/id=([\w-]+)/);
+        if (!match) return;
+        const id = match[1];
         const api = `https://api.openreview.net/notes?id=${id}`;
         let response = await fetch(api);
         let json = await response.json();
@@ -101,7 +103,9 @@ export function initBackground() {
     };
 
     const fetchOpenReviewForumJSON = async (url) => {
-        const id = url.match(/id=([\w-])+/)[0].replace("id=", "");
+        const match = url.match(/id=([\w-]+)/);
+        if (!match) return;
+        const id = match[1];
         const api = `https://api.openreview.net/notes?forum=${id}`;
         let response = await fetch(api);
         let json = await response.json();
@@ -161,29 +165,8 @@ export function initBackground() {
     };
 
     const fetchPWCData = async (arxivId, title) => {
-        return; // PWC API discontinued, to fix later
-        let pwcPath = `https://paperswithcode.com/api/v1/papers/?`;
-        if (arxivId) {
-            log("Fetching PWC data for arxivId:", arxivId);
-            pwcPath += new URLSearchParams({ arxiv_id: arxivId });
-        } else if (title) {
-            log("Fetching PWC data for paper:", title);
-            pwcPath += new URLSearchParams({ title });
-        }
-        const response = await fetch(pwcPath);
-        try {
-            const json = await response.json();
-        } catch (error) {
-            logError("[fetchPWCData]", error);
-            return;
-        }
-
-        if (json["count"] !== 1) {
-            log("No PWC entry match.");
-            return;
-        }
-        log("PWC entry match:", json["results"][0]["id"]);
-        return json["results"][0];
+        // PWC API discontinued, to fix later
+        return;
     };
 
     const findCodesForPaper = async (request) => {
@@ -323,7 +306,6 @@ export function initBackground() {
 
     const pushSyncPapers = async () => {
         if (!(await shouldSync())) return;
-        const identifier = await getIdentifier();
         try {
             const start = Date.now();
             consoleHeader(`Pushing ${String.fromCodePoint("0x23EB")}`);
@@ -359,6 +341,9 @@ export function initBackground() {
     };
 
     chrome.runtime.onMessage.addListener((payload, sender, sendResponse) => {
+        if (sender.id !== chrome.runtime.id) {
+            return;
+        }
         if (payload.type === "update-title") {
             const { title, url } = payload.options;
             paperTitles[url] = title.replaceAll('"', "'");
@@ -379,12 +364,15 @@ export function initBackground() {
                     });
                 }
                 const safeTitle = payload.title
-                    .replaceAll("?", "")
-                    .replaceAll(":", "")
-                    .replaceAll("..", "")
-                    .replaceAll("/", "_")
-                    .replaceAll("\\", "_");
+                    .replace(/[<>:"/\\|?*\x00-\x1f]/g, "_")
+                    .replace(/\.{2,}/g, ".")
+                    .replace(/^\.+|\.+$/g, "")
+                    .slice(0, 200);
                 const filename = "PaperMemoryStore/" + safeTitle;
+                if (!/^https?:\/\//.test(payload.pdfUrl)) {
+                    sendResponse(false);
+                    return;
+                }
                 chrome.downloads.download({ url: payload.pdfUrl, filename });
                 sendResponse(true);
             });
@@ -434,11 +422,10 @@ export function initBackground() {
                     console.log(">>> Setting tab title to :", paperTitle);
                     chrome.scripting.executeScript({
                         target: { tabId },
-                        code: `
-                        ${setTitleCode(paperTitle)};
-                        ${setFaviconCode};
-                    `,
-                        runAt: "document_start",
+                        func: (title) => {
+                            document.title = title;
+                        },
+                        args: [paperTitle],
                     });
                 }
             }

src/bibMatcher/bibMatcher.js

@@ -9,7 +9,7 @@ import {
     hideId,
     querySelector,
 } from "@pmu/miniquery.js";
-import { copyTextToClipboard } from "@pmu/functions.js";
+import { copyTextToClipboard, escapeHtml } from "@pmu/functions.js";
 import { BibtexParser, bibtexToObject, bibtexToString } from "@pmu/bibtexParser.js";
 import {
     tryDBLP,
@@ -313,7 +313,7 @@ const matchItems = async (papersToMatch) => {
         setHTML("matching-status-index", idx + 1);
         setHTML(
             "matching-status-title",
-            paper.title.replaceAll("{", "").replaceAll("}", ""),
+            escapeHtml(paper.title.replaceAll("{", "").replaceAll("}", "")),
         );
         changeProgress(parseInt((idx / papersToMatch.length) * 100));
 
@@ -365,10 +365,10 @@ const updateMatchedTitles = (matchedBibtexStrs, sources, venues) => {
         for (const [idx, title] of titles.entries()) {
             htmls.push(
                 `<tr>
-                    <th class="match-citation-key">${keys[idx]}</th>
-                    <th class='match-title'>${title}</th>
-                    <th class="match-venue">${venues[idx]}</th>
-                    <th class="match-source">${sources[idx]}</th>
+                    <th class="match-citation-key">${escapeHtml(keys[idx])}</th>
+                    <th class='match-title'>${escapeHtml(title)}</th>
+                    <th class="match-venue">${escapeHtml(venues[idx])}</th>
+                    <th class="match-source">${escapeHtml(sources[idx])}</th>
                 </tr>`,
             );
         }

src/content_scripts/content_script.js

@@ -19,6 +19,7 @@ import {
     sendMessageToBackground,
     downloadURI,
     dummyEvent,
+    escapeHtml,
 } from "@pmu/functions.js";
 import { bibtexToString, bibtexToObject } from "@pmu/bibtexParser.js";
 import {
@@ -135,7 +136,6 @@ $.extend($.easing, {
     },
 });
 
-var PDF_TITLE_ITERS = 0;
 
 /**
  * Centralizes HTML svg codes
@@ -254,8 +254,8 @@ const makePaperMemoryHTMLDiv = (paper) => {
                 style="display: flex; justify-content: center; align-items: center;" 
                 id="pm-venue"
             >
-                <span id="pm-venue-name">${paper.venue}</span>
-                <span id="pm-venue-year">${bibtexToObject(paper.bibtex).year}</span>
+                <span id="pm-venue-name">${escapeHtml(paper.venue)}</span>
+                <span id="pm-venue-year">${escapeHtml(bibtexToObject(paper.bibtex).year)}</span>
             </div>
             <p
                 style="text-align: center; font-size: 12px; color: #666; margin: 0;"
@@ -448,12 +448,14 @@ const contentScriptMain = async ({
             if (!state.papers.hasOwnProperty(id)) return;
             const paper = state.papers[id];
             const maxWait = 60 * 1000;
-            while (1) {
-                const waitTime = Math.min(maxWait, 250 * 2 ** PDF_TITLE_ITERS);
+            const maxIters = 20;
+            let pdfTitleIters = 0;
+            while (pdfTitleIters < maxIters) {
+                const waitTime = Math.min(maxWait, 250 * 2 ** pdfTitleIters);
                 await sleep(waitTime);
                 document.title = "";
                 document.title = paper.title;
-                PDF_TITLE_ITERS++;
+                pdfTitleIters++;
             }
         };
         makeTitle(id);
@@ -608,8 +610,8 @@ const displayPaperVenue = (paper) => {
     const venueDiv = /*html*/ `
         <div id="pm-publication-wrapper">
             <div id="pm-publication-venue">
-                <span id="pm-venue-name">${paper.venue}</span>
-                <span id="pm-venue-year">${bibtexToObject(paper.bibtex).year}</span>
+                <span id="pm-venue-name">${escapeHtml(paper.venue)}</span>
+                <span id="pm-venue-year">${escapeHtml(bibtexToObject(paper.bibtex).year)}</span>
             </div>
         </div>`;
     findEl({ element: "pm-publication-wrapper" })?.remove();
@@ -627,9 +629,11 @@ const displayPaperCode = (paper) => {
     if (!paper.codeLink) {
         return;
     }
+    const safeLink = /^https?:\/\//.test(paper.codeLink) ? escapeHtml(paper.codeLink) : "";
+    if (!safeLink) return;
     const code = /*html*/ `
         <div id="pm-code">
-        <h3>Code:</h3> <a id="pm-code-link" href="${paper.codeLink}">${paper.codeLink}</a>
+        <h3>Code:</h3> <a id="pm-code-link" href="${safeLink}">${safeLink}</a>
         </div>
     `;
     findEl({ element: "pm-code" })?.remove();
@@ -648,14 +652,15 @@ const huggingfacePapers = (paper, url) => {
     const venueDiv = /*html*/ `
         <div id="pm-publication-wrapper">
             <div id="pm-publication-venue">
-                <span id="pm-venue-name">${paper.venue}</span>
-                <span id="pm-venue-year">${bibtexToObject(paper.bibtex).year}</span>
+                <span id="pm-venue-name">${escapeHtml(paper.venue)}</span>
+                <span id="pm-venue-year">${escapeHtml(bibtexToObject(paper.bibtex).year)}</span>
                 <span id="pm-hf-label">(PaperMemory)</span>
             </div>
         </div>`;
-    abstractH2 = queryAll("h2").find((h) => h.innerText.trim() === "Abstract");
+    const abstractH2 = queryAll("h2").find((h) => h.innerText.trim() === "Abstract");
     if (!abstractH2) {
         log("Missing 'Abstract' h2 title on HuggingFace paper page.");
+        return;
     }
     const authorDiv = abstractH2.parentElement.previousElementSibling;
     log("Adding venue to HuggingFace paper page.");
@@ -852,7 +857,7 @@ const updateCompleteSecretHTML = (paper) => {
                 .querySelector("head")
                 .insertAdjacentHTML(
                     "beforeend",
-                    /*html*/ `<meta name="pm-complete-secret-html" content="${paper.id}">`,
+                    /*html*/ `<meta name="pm-complete-secret-html" content="${escapeHtml(paper.id)}">`,
                 );
         }
     }, 50);