prevent embedding wallet pages in other web pages

1 files changed, 12 insertions, 0 deletions

diff --git a/src/webex/pages/redirect.js b/src/webex/pages/redirect.js
new file mode 100644
index 000000000..5a758cce4
--- /dev/null
+++ b/src/webex/pages/redirect.js
@@ -0,0 +1,12 @@
+/**
+ * This is the entry point for redirects, and should be the only
+ * web-accessible resource declared in the manifest.  This prevents
+ * malicious websites from embedding wallet pages in them.
+ * 
+ * We still need this redirect page since a webRequest can only directly
+ * redirect to pages inside the extension that are a web-accessible resource.
+ */
+
+ 
+const myUrl = new URL(window.location.href);
+window.location.replace(myUrl.searchParams.get("url"));