Merge pull request #259 from ezzak/coverage_fix

Fix missing WA check in recent worker CSP improvements

Author: rich-hansen

config/v2/manifest.json

@@ -1,7 +1,7 @@
 {
     "manifest_version": 2,
     "name": "Code Verify",
-    "version": "3.2.0",
+    "version": "3.2.1",
     "default_locale": "en",
     "description": "An extension to verify the code running in your browser matches what was published.",
     "page_action": {

config/v3/manifest.json

@@ -1,7 +1,7 @@
 {
     "manifest_version": 3,
     "name": "Code Verify",
-    "version": "3.2.0",
+    "version": "3.2.1",
     "default_locale": "en",
     "description": "An extension to verify the code running in your browser matches what was published.",
     "action": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "meta-code-verify",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Browser extensions to verify code running in the browser against a published manifest",
   "main": "none",
   "repository": "git@github.com:facebookincubator/meta-code-verify.git",

src/js/contentUtils.ts

@@ -528,21 +528,23 @@ chrome.runtime.onMessage.addListener(request => {
       ) {
         return;
       }
-      const hostname = window.location.hostname;
-      const resourceURL = new URL(request.response.url);
-      if (resourceURL.hostname === hostname) {
-        // This can potentially be a worker, check if CSPs allow it as a worker
-        if (
-          allowedWorkerCSPs.every(csp =>
-            doesWorkerUrlConformToCSP(csp, resourceURL.toString()),
-          )
-        ) {
-          // This might be a worker, ensure it's CSP headers are valid
-          checkWorkerEndpointCSP(
-            request.response,
-            allowedWorkerCSPs,
-            currentOrigin.val,
-          );
+      if (isFbMsgrOrIgOrigin(currentOrigin.val)) {
+        const hostname = window.location.hostname;
+        const resourceURL = new URL(request.response.url);
+        if (resourceURL.hostname === hostname) {
+          // This can potentially be a worker, check if CSPs allow it as a worker
+          if (
+            allowedWorkerCSPs.every(csp =>
+              doesWorkerUrlConformToCSP(csp, resourceURL.toString()),
+            )
+          ) {
+            // This might be a worker, ensure it's CSP headers are valid
+            checkWorkerEndpointCSP(
+              request.response,
+              allowedWorkerCSPs,
+              currentOrigin.val,
+            );
+          }
         }
       }
       sendMessageToBackground({