check for contract freshness

1 files changed, 8 insertions, 2 deletions

diff --git a/src/content_scripts/notify.ts b/src/content_scripts/notify.ts
index 10b988c43..d29e5913d 100644
--- a/src/content_scripts/notify.ts
+++ b/src/content_scripts/notify.ts
@@ -173,7 +173,9 @@ namespace TalerNotify {
     (detail: any, sendResponse: (msg: any) => void): void;
   }
 
-  function downloadContract(url: string): Promise<any> {
+  function downloadContract(url: string, nonce: string): Promise<any> {
+    let parsed_url = URI(url);
+    url = parsed_url.setQuery({nonce}).href();
     // FIXME: include and check nonce!
     return new Promise((resolve, reject) => {
       const contract_request = new XMLHttpRequest();
@@ -356,7 +358,11 @@ namespace TalerNotify {
         return;
       }
       if (msg.contract_url) {
-        let proposal = await downloadContract(msg.contract_url);
+        let nonce = Math.round(Math.random() * 0xFFFF).toString()
+        let proposal = await downloadContract(msg.contract_url, nonce);
+        if (proposal.data.nonce != nonce) {
+          console.error("stale contract");
+        }
         await processProposal(proposal);
         return;
       }