Cap Google Chrome extension

[richiemcilroy]

The official Cap Google Chrome extension.

[greptile-apps]

Too many files changed for review. (162 files found, 100 file limit)

[polarityinc]

Paragon Review Skipped

Hi @richiemcilroy! Your Polarity credit balance is insufficient to complete this review.

Please visit https://app.paragon.run to finish your review.

[tembo]

decodeURIComponent can throw on malformed %-escapes, and this is a web-accessible page, so it’s easy for a hostile embed to crash the UI via #%.... Also, you can avoid using "*" here by scoping the postMessage target to the embedding page’s origin.

Suggested change

	const PANEL_TOKEN = decodeURIComponent(window.location.hash.slice(1));
	const IS_EMBEDDED = PANEL_TOKEN.length > 0 && window.parent !== window;
	const DEFAULT_MEDIA_ACCESS: MediaAccessState = {
	camera: false,
	microphone: false,
	updatedAt: 0,
	};
	const postPanelMessage = (
	message: { type: "size"; height: number } | { type: "dismiss" },
	) => {
	if (!IS_EMBEDDED) return;
	window.parent.postMessage(
	{
	source: "cap-extension-panel",
	token: PANEL_TOKEN,
	...message,
	},
	"*",
	);
	};
	const PANEL_TOKEN = (() => {
	try {
	return decodeURIComponent(window.location.hash.slice(1));
	} catch {
	return "";
	}
	})();
	const IS_EMBEDDED = PANEL_TOKEN.length > 0 && window.parent !== window;
	const PANEL_PARENT_ORIGIN = (() => {
	try {
	return new URL(document.referrer).origin;
	} catch {
	return "*";
	}
	})();
	const DEFAULT_MEDIA_ACCESS: MediaAccessState = {
	camera: false,
	microphone: false,
	updatedAt: 0,
	};
	const postPanelMessage = (
	message: { type: "size"; height: number } | { type: "dismiss" },
	) => {
	if (!IS_EMBEDDED) return;
	window.parent.postMessage(
	{
	source: "cap-extension-panel",
	token: PANEL_TOKEN,
	...message,
	},
	PANEL_PARENT_ORIGIN,
	);
	};

[tembo]

Same decodeURIComponent footgun here — a malformed hash can crash the preview iframe before it ever registers.

Suggested change

	const token = decodeURIComponent(window.location.hash.slice(1));
	const token = (() => {
	try {
	return decodeURIComponent(window.location.hash.slice(1));
	} catch {
	return "";
	}
	})();