Prevent bypasses

ext/background.js

@@ -245,14 +245,21 @@ function webNavigationonCompleted(details) {
     }
 };
 
+function trustedInitiator(details) {
+	if (details.initiator.startsWith('chrome-extension://')) return true;
+	if (details.initiator.startsWith('chrome://newtab/')) return true;
+	if (details.initiator.startsWith('edge://newtab/')) return true;
+	return false;
+}
+
 /**
  * - check if a request is suspicious, based on 7 conditions
  * - if suspicious, store request data, for @xhRequest
  * @param {details of request} details 
  */
 function onBeforeSendHeaders(details) {
 
-    if(details.tabId == -1) {
+    if(details.tabId == -1 && trustedInitiator(details)) {
         //delete requestBody[details.requestId];
         return { requestHeaders: details.requestHeaders };
     }
@@ -311,10 +318,7 @@ function onBeforeSendHeaders(details) {
         // condition: whether the tab URL is valid
         if((navigation[details.tabId] == true && !tabrelations[details.tabId]) ||
             (!utils.isEmpty(tabPendingUrl[details.tabId]) && tabUrl[details.tabId].toLowerCase() !== tabPendingUrl[details.tabId].toLowerCase()) ||
-            details.tabId == -1 ||
-            tabUrl[details.tabId].toLowerCase().startsWith("chrome://newtab/") ||
-            tabUrl[details.tabId].toLowerCase().startsWith("chrome-extension://") ||
-            tabUrl[details.tabId].toLowerCase().startsWith("edge://newtab/")) {
+            trustedInitiator(details)) {
             return { requestHeaders: details.requestHeaders };
         }
 
@@ -412,6 +416,15 @@ function onBeforeSendHeaders(details) {
     return { requestHeaders: utils.removeRequestHeaders(details, 'Cookie') };
 };
 
+function allowsOpener(details) {
+       for (let i = 0; i < details.responseHeaders.length; ++i) {
+            if (details.responseHeaders[i].name.toLowerCase() === 'cross-origin-opener-policy' && details.responseHeaders[i].value.toLowerCase() !== 'unsafe-none') {
+                return false;
+            }
+        }
+        return true;
+}
+
 /**
  * - store first response headers for suspicious requests
  * into memory, to be used by @xhRequest
@@ -445,6 +458,11 @@ function onHeadersReceived(details) {
         // return response to first request, with Set-Cookie header removed
         return { responseHeaders: utils.removeResponseHeaders(details, 'Set-Cookie') };
     }
+
+    if (!tabrelations[details.tabId] && allowsOpener(details)) {
+	    details.responseHeaders.push({name: "cross-origin-opener-policy", value: "same-origin-allow-popups"});
+	    return { responseHeaders: details.responseHeaders };
+    }
 };
 
 /**

ext/options.js

@@ -54,7 +54,7 @@ function populateExcludeList(data) {
         for(let r = 0; r < data.length; r++) {
             let opt = document.createElement("option");
             opt.value = r;
-            opt.innerHTML = data[r][0] + " => " + data[r][1];
+            opt.innerText = data[r][0] + " => " + data[r][1];
             excludeSelect.appendChild(opt);
         }
     }
@@ -68,7 +68,7 @@ function populateIgnoreList(data) {
         for(let r = 0; r < data.length; r++) {
             let opt = document.createElement("option");
             opt.value = r;
-            opt.innerHTML = data[r][0] + " => " + data[r][1];
+            opt.innerText = data[r][0] + " => " + data[r][1];
             ignoreSelect.appendChild(opt);
         }
     }
@@ -115,7 +115,7 @@ function excludeAddListener() {
         let excludeSelect = document.getElementById('excludedMappingsBox');
         let opt = document.createElement("option");
         opt.value = excludeSelect.length;
-        opt.innerHTML = originVal + " => " + targetVal;
+        opt.innerText = originVal + " => " + targetVal;
         excludeSelect.appendChild(opt);
     });
 }
@@ -168,7 +168,7 @@ function ignoreAddListener() {
         let ignoreSelect = document.getElementById('ignoredMappingsBox');
         let opt = document.createElement("option");
         opt.value = ignoreSelect.length;
-        opt.innerHTML  = originVal + " => " + targetVal;
+        opt.innerText  = originVal + " => " + targetVal;
         ignoreSelect.appendChild(opt);
     });
 }