Commit Graph

3 Commits

Author SHA1 Message Date
Bruno Pantaleão Gonçalves
92214b873d Use explicit URL.port and remove fallback in SafeScriptMessageHandler (#4483)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

Remove the portWithFallback helper and update port comparisons to use
URL.port directly. baseIsEqual now compares ports via url.port (no
80/443 fallback), and SafeScriptMessageHandler passes url.port ?? 0 when
building origin keys (security origin uses port 0 when unspecified).
This simplifies port handling and avoids implicit defaulting to standard
ports.

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-04-07 16:47:39 +02:00
Bruno Pantaleão Gonçalves
034b8b3afa Validate script message origin (host:port) (#4470) 2026-04-02 22:21:04 +02:00
Bruno Pantaleão Gonçalves
c8f35e4cff Prevent execution of WKUserScript from beyond main frame and allowed hosts (#4469)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-04-02 13:52:29 +02:00