|
| 1 | +<!DOCTYPE html> |
| 2 | +<html lang="en"> |
| 3 | +<head> |
| 4 | + <meta charset="UTF-8"> |
| 5 | + <title>Extension Sandbox Origin Validation Test</title> |
| 6 | + <style> |
| 7 | + * { box-sizing: border-box; } |
| 8 | + body { font-family: system-ui, -apple-system, sans-serif; background: #0f0f23; color: #e0e0e0; padding: 24px; margin: 0; } |
| 9 | + h1 { color: #ff79c6; margin-bottom: 4px; } |
| 10 | + .subtitle { color: #888; margin-bottom: 24px; } |
| 11 | + .grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 16px; margin-bottom: 24px; } |
| 12 | + .card { background: #1a1a2e; border: 1px solid #333; border-radius: 8px; padding: 16px; } |
| 13 | + .card h3 { margin: 0 0 8px; font-size: 14px; color: #bd93f9; } |
| 14 | + .card .detail { font-size: 12px; color: #888; margin-bottom: 12px; } |
| 15 | + .card iframe { width: 100%; height: 100px; border: 1px solid #444; border-radius: 4px; } |
| 16 | + .result { margin-top: 12px; padding: 8px; border-radius: 4px; font-size: 13px; font-weight: 600; } |
| 17 | + .result.pass { background: #0f5132; color: #75b798; border: 1px solid #0f5132; } |
| 18 | + .result.fail { background: #842029; color: #ea868f; border: 1px solid #842029; } |
| 19 | + .result.waiting { background: #332701; color: #ffda6a; border: 1px solid #332701; } |
| 20 | + .instructions { background: #1a1a2e; border: 1px solid #333; border-radius: 8px; padding: 16px; font-size: 13px; line-height: 1.6; } |
| 21 | + .instructions code { background: #2a2a3e; padding: 2px 6px; border-radius: 3px; font-size: 12px; } |
| 22 | + </style> |
| 23 | +</head> |
| 24 | +<body> |
| 25 | + <h1>Sandbox Origin Validation Test</h1> |
| 26 | + <p class="subtitle">Bug bounty #621 — Verify sandboxed frames cannot receive the Uniswap provider</p> |
| 27 | + |
| 28 | + <div class="grid"> |
| 29 | + <div class="card"> |
| 30 | + <h3>1. Normal Frame (no sandbox)</h3> |
| 31 | + <div class="detail">Expected: origin = http://localhost:*, Uniswap provider = PRESENT</div> |
| 32 | + <iframe id="frame-normal" src="child.html"></iframe> |
| 33 | + <div id="result-normal" class="result waiting">Waiting for report...</div> |
| 34 | + </div> |
| 35 | + |
| 36 | + <div class="card"> |
| 37 | + <h3>2. Sandboxed (allow-scripts only)</h3> |
| 38 | + <div class="detail">Expected: origin = "null", Uniswap provider = ABSENT</div> |
| 39 | + <iframe id="frame-sandboxed" src="child.html" sandbox="allow-scripts"></iframe> |
| 40 | + <div id="result-sandboxed" class="result waiting">Waiting for report...</div> |
| 41 | + </div> |
| 42 | + |
| 43 | + <div class="card"> |
| 44 | + <h3>3. Sandboxed (allow-scripts + allow-same-origin)</h3> |
| 45 | + <div class="detail">Expected: origin = http://localhost:*, Uniswap provider = PRESENT</div> |
| 46 | + <iframe id="frame-same-origin" src="child.html" sandbox="allow-scripts allow-same-origin"></iframe> |
| 47 | + <div id="result-same-origin" class="result waiting">Waiting for report...</div> |
| 48 | + </div> |
| 49 | + </div> |
| 50 | + |
| 51 | + <div class="instructions"> |
| 52 | + <strong>How to use:</strong><br> |
| 53 | + 1. Serve this directory: <code>python3 -m http.server 8080</code><br> |
| 54 | + 2. Load the extension in Chrome (webpack dev build via <code>bun start:webpack</code>)<br> |
| 55 | + 3. Open <code>http://localhost:8080</code> in Chrome<br> |
| 56 | + 4. All three cards should show their expected results (green = pass, red = fail)<br> |
| 57 | + <br> |
| 58 | + <strong>Note:</strong> This test detects the <strong>Uniswap provider specifically</strong> via EIP-6963 (<code>rdns: org.uniswap.app</code>), |
| 59 | + so other wallet extensions (MetaMask, etc.) won't cause false positives. |
| 60 | + </div> |
| 61 | + |
| 62 | + <script> |
| 63 | + const expectations = { |
| 64 | + normal: { originIsNull: false, hasUniswapProvider: true }, |
| 65 | + sandboxed: { originIsNull: true, hasUniswapProvider: false }, |
| 66 | + 'same-origin': { originIsNull: false, hasUniswapProvider: true }, |
| 67 | + }; |
| 68 | + |
| 69 | + const received = {}; |
| 70 | + |
| 71 | + window.addEventListener('message', (event) => { |
| 72 | + if (!event.data || event.data.type !== 'sandbox-test-report') { |
| 73 | + return; |
| 74 | + } |
| 75 | + |
| 76 | + const { origin, hasUniswapProvider } = event.data; |
| 77 | + const isNull = origin === 'null'; |
| 78 | + |
| 79 | + // Determine which frame sent this |
| 80 | + let frameId = null; |
| 81 | + for (const [id, expect] of Object.entries(expectations)) { |
| 82 | + if (received[id]) continue; |
| 83 | + if (expect.originIsNull === isNull) { |
| 84 | + frameId = id; |
| 85 | + break; |
| 86 | + } |
| 87 | + } |
| 88 | + |
| 89 | + // Fallback: match by source iframe |
| 90 | + if (!frameId) { |
| 91 | + const frames = ['normal', 'sandboxed', 'same-origin']; |
| 92 | + for (const id of frames) { |
| 93 | + if (received[id]) continue; |
| 94 | + const iframe = document.getElementById('frame-' + id); |
| 95 | + try { |
| 96 | + if (event.source === iframe.contentWindow) { |
| 97 | + frameId = id; |
| 98 | + break; |
| 99 | + } |
| 100 | + } catch (e) { /* cross-origin access may throw */ } |
| 101 | + } |
| 102 | + } |
| 103 | + |
| 104 | + if (!frameId) return; |
| 105 | + received[frameId] = true; |
| 106 | + |
| 107 | + const expect = expectations[frameId]; |
| 108 | + const originPass = expect.originIsNull === isNull; |
| 109 | + const providerPass = expect.hasUniswapProvider === hasUniswapProvider; |
| 110 | + const allPass = originPass && providerPass; |
| 111 | + |
| 112 | + const el = document.getElementById('result-' + frameId); |
| 113 | + el.className = 'result ' + (allPass ? 'pass' : 'fail'); |
| 114 | + el.innerHTML = ` |
| 115 | + ${allPass ? 'PASS' : 'FAIL'} — |
| 116 | + origin: ${origin} (${originPass ? 'ok' : 'WRONG'}), |
| 117 | + Uniswap provider: ${hasUniswapProvider ? 'present' : 'absent'} (${providerPass ? 'ok' : 'WRONG'}) |
| 118 | + `; |
| 119 | + }); |
| 120 | + |
| 121 | + // Timeout fallback |
| 122 | + setTimeout(() => { |
| 123 | + for (const id of Object.keys(expectations)) { |
| 124 | + if (!received[id]) { |
| 125 | + const el = document.getElementById('result-' + id); |
| 126 | + if (el.classList.contains('waiting')) { |
| 127 | + el.className = 'result fail'; |
| 128 | + el.textContent = 'No report received (frame may be blocked)'; |
| 129 | + } |
| 130 | + } |
| 131 | + } |
| 132 | + }, 5000); |
| 133 | + </script> |
| 134 | +</body> |
| 135 | +</html> |
0 commit comments