Merge pull request #1634 from keepassxreboot/fix/prevent_cross_origin_requests

Prevent Cross-Origin requests to KeePassXC

1 files changed, 8 insertions, 0 deletions

diff --git a/keepassxc-browser/content/keepassxc-browser.js b/keepassxc-browser/content/keepassxc-browser.js
index 97cd6f0..b93dd0a 100755
--- a/keepassxc-browser/content/keepassxc-browser.js
+++ b/keepassxc-browser/content/keepassxc-browser.js
@@ -588,6 +588,14 @@ kpxc.retrieveCredentialsCallback = async function(credentials) {
 // If credentials are not received, request them again
 kpxc.receiveCredentialsIfNecessary = async function() {
     if (kpxc.credentials.length === 0 && !_called.retrieveCredentials) {
+        // Check for Cross-domain security error when inspecting window.top.location.href. We should ignore these requests.
+        try {
+            const currentLocation = window.top.location.href;
+        } catch (err) {
+            logDebug('Error: Credential request ignored from another domain: ', window.self.location.host);
+            return [];
+        }
+
         if (!kpxc.url) {
             kpxc.url = document.location.href;
         }