Aug 26 - Enhance security 3

extension/popup/popup.html

@@ -621,6 +621,9 @@
       </nav>
     </div>
     <!-- /app -->
+    <!-- Public Suffix List — must load before popup.js, which calls PkPsl
+         from isMatch() to decide which stored items belong to the active tab. -->
+    <script src="../shared/psl.js"></script>
     <script src="../shared/crypto.js"></script>
     <script src="../shared/sharing-crypto.js"></script>
     <script src="popup.js"></script>

extension/popup/popup.js

@@ -220,15 +220,28 @@ function _normaliseUrl(raw) {
   return "https://" + s;
 }
 
+/**
+ * Does this stored item belong to the site in the active tab?
+ *
+ * Compared by registrable domain (PkPsl.isSameSite), not by suffix. The old
+ * test had no notion of a public suffix, so victim.github.io matched
+ * evil.github.io and an item saved for a bare TLD matched every site under it.
+ * Must stay in step with _filterForHost() in content/content.js.
+ *
+ * Falls back to exact hostname equality if psl.js failed to load — strict, so a
+ * load failure loses matches rather than leaking credentials.
+ */
 function isMatch(item) {
   const host = currentHostname();
   if (!host || item.item_type !== "password" || !item.plain?.url) return false;
   try {
     const normalised = _normaliseUrl(item.plain.url);
     if (!normalised) return false;
-    const h = new URL(normalised).hostname.replace(/^www\./, "");
-    // Match exact domain or any subdomain relationship.
-    return h === host || h.endsWith(`.${host}`) || host.endsWith(`.${h}`);
+    const itemHost = new URL(normalised).hostname;
+    if (typeof PkPsl !== "undefined" && PkPsl?.isSameSite) {
+      return PkPsl.isSameSite(itemHost, host);
+    }
+    return itemHost.toLowerCase() === String(host).toLowerCase();
   } catch {
     return false;
   }