Aug 26 - Enhance security 3

extension/content/content.js

@@ -922,17 +922,39 @@
     return "https://" + s; // bare domain or path
   }
 
+  /**
+   * Select the stored items whose URL belongs to the page we are on.
+   *
+   * Matching is by registrable domain (PkPsl.isSameSite), NOT by suffix
+   * comparison. The previous test was:
+   *
+   *     h === host || h.endsWith("." + host) || host.endsWith("." + h)
+   *
+   * which had no notion of a public suffix, so a credential saved for
+   * victim.github.io was offered on evil.github.io, and one saved for a bare
+   * TLD was offered everywhere under it. Surfacing a match on an attacker's
+   * neighbouring subdomain defeats the phishing resistance that is most of the
+   * point of a password manager.
+   *
+   * If psl.js somehow failed to load we fall back to exact hostname equality —
+   * strict, so a load failure loses matches rather than leaking credentials.
+   */
   function _filterForHost(items) {
-    var host = location.hostname.replace(/^www\./, "");
+    var host = location.hostname;
+    var sameSite =
+      typeof PkPsl !== "undefined" && PkPsl && PkPsl.isSameSite
+        ? PkPsl.isSameSite
+        : function (a, b) {
+            return String(a).toLowerCase() === String(b).toLowerCase();
+          };
+
     return (items || []).filter(function (item) {
       if (item.item_type !== "password" || !(item.plain && item.plain.url))
         return false;
       try {
         var normalised = _normaliseUrl(item.plain.url);
         if (!normalised) return false;
-        var h = new URL(normalised).hostname.replace(/^www\./, "");
-        // Match exact domain or any subdomain relationship.
-        return h === host || h.endsWith("." + host) || host.endsWith("." + h);
+        return sameSite(new URL(normalised).hostname, host);
       } catch (e) {
         console.warn(
           "[PassKeeper] _filterForHost: could not parse URL:",