missing origin/source check on store.steampowered.com cache-invalidation postMessage listener

Inizia da scripts/store/invalidate_cache.js:17-29 e confronta il relativo listener dei messaggi con quello di scripts/steamdb/global.js:25-30. Verifica il sender esistente di MAIN-world ed esegui i check pertinenti dell’estensione oppure un test mirato di message-event. Il lavoro è completo quando i messaggi provenienti da un origin o da una source esterni non attivano più l’invalidazione della cache, mentre i messaggi della stessa finestra continuano a farlo.

Summary

scripts/store/invalidate_cache.js listens for window "message" events and, on receiving { type: 'steamdb:extension-invalidate-cache' }, forwards a privileged InvalidateCache request to the background service worker with no check on event.origin or event.source. Any foreign origin can window.open() a store.steampowered.com tab and postMessage() this trigger directly, wiping the extension's cached Steam user/library/family data.

The near-identical listener on steamdb.info (scripts/steamdb/global.js:25-30) correctly checks request.origin !== window.location.origin -- this copy of the same feature just forgot it.

Root cause

// scripts/store/invalidate_cache.js:17-29
window.addEventListener( 'message', ( request ) =>
{
	if( request?.data && request.data.type === 'steamdb:extension-invalidate-cache' )
	{
		SendMessageToBackgroundScript( { contentScriptQuery: 'InvalidateCache' }, () => {} );
	}
} );

No origin/source check. store.steampowered.com sets frame-ancestors 'none' (can't be iframed) but no Cross-Origin-Opener-Policy, so a window.open() popup retains a scriptable cross-origin opener relationship -- enough to reach this listener.

Proof of concept (live-verified)

Loaded the real unpacked extension in Chrome via Puppeteer/CDP, mapping store.steampowered.com and an unrelated attacker.example to local fixtures, observed the real background service worker's chrome.storage.local:

// on https://attacker.example/
window.__popup = window.open('https://store.steampowered.com/', 'victim');
window.__popup.postMessage({ type: 'steamdb:extension-invalidate-cache' }, '*');

BEFORE: {"userdata.cached":111111,"userfamilydata":"{\"seed\":true}"}
AFTER:  {"userdata.cached":1789393938791,"userfamilydata":"{}"}
CACHE WAS INVALIDATED BY FORGED CROSS-ORIGIN MESSAGE

Impact

Low: only reachable privileged action is InvalidateCache() -- forces re-fetch of the user's own dynamicstore/userdata endpoint, minor nuisance DoS + transient loss of "already owned" highlighting. No data exfiltration (fetch targets Steam's own endpoint with credentials, response never reaches the attacker). No other contentScriptQuery is reachable through this listener.

Suggested fix

window.addEventListener( 'message', ( request ) =>
{
	if( request.source !== window || request.origin !== window.location.origin )
	{
		return;
	}
	if( request?.data && request.data.type === 'steamdb:extension-invalidate-cache' )
	{
		...

Mirrors the already-correct pattern in scripts/steamdb/global.js; the MAIN-world sender already targets window.location.origin explicitly, so this has no functional downside.

This report was produced with AI assistance (Claude, Anthropic): manifest review, source tracing, and a live end-to-end Puppeteer/CDP proof-of-concept against the real unpacked extension.