From b5f377a8be5c06f796c59058155da710a6aec5ab Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 4 Apr 2026 21:22:40 -0700 Subject: [PATCH] fix: remove CORS wildcard, restrict to localhost (H1) Replace Access-Control-Allow-Origin: * with http://127.0.0.1 on sidebar tab/chat endpoints. The Chrome extension uses manifest host_permissions to bypass CORS entirely, so this only blocks malicious websites from making cross-origin requests. Closes H1 from security audit #783. Co-Authored-By: Claude Opus 4.6 (1M context) --- browse/src/server.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/browse/src/server.ts b/browse/src/server.ts index 0348489a..bc399a6d 100644 --- a/browse/src/server.ts +++ b/browse/src/server.ts @@ -1229,12 +1229,12 @@ async function start() { const tabs = await browserManager.getTabListWithTitles(); return new Response(JSON.stringify({ tabs }), { status: 200, - headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }, + headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' }, }); } catch (err: any) { return new Response(JSON.stringify({ tabs: [], error: err.message }), { status: 200, - headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }, + headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' }, }); } } @@ -1253,7 +1253,7 @@ async function start() { browserManager.switchTab(tabId); return new Response(JSON.stringify({ ok: true, activeTab: tabId }), { status: 200, - headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }, + headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' }, }); } catch (err: any) { return new Response(JSON.stringify({ error: err.message }), { status: 400, headers: { 'Content-Type': 'application/json' } }); @@ -1275,7 +1275,7 @@ async function start() { const tabAgentStatus = tabId !== null ? getTabAgentStatus(tabId) : agentStatus; return new Response(JSON.stringify({ entries, total: chatNextId, agentStatus: tabAgentStatus, activeTabId: activeTab }), { status: 200, - headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }, + headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' }, }); }