missing origin/source check on store.steampowered.com cache-invalidation postMessage listener

[router0mail]

Summary

scripts/store/invalidate_cache.js listens for window "message" events and, on receiving { type: 'steamdb:extension-invalidate-cache' }, forwards a privileged InvalidateCache request to the background service worker with no check on event.origin or event.source. Any foreign origin can window.open() a store.steampowered.com tab and postMessage() this trigger directly, wiping the extension's cached Steam user/library/family data.

The near-identical listener on steamdb.info (scripts/steamdb/global.js:25-30) correctly checks request.origin !== window.location.origin -- this copy of the same feature just forgot it.

Root cause

// scripts/store/invalidate_cache.js:17-29
window.addEventListener( 'message', ( request ) =>
{
	if( request?.data && request.data.type === 'steamdb:extension-invalidate-cache' )
	{
		SendMessageToBackgroundScript( { contentScriptQuery: 'InvalidateCache' }, () => {} );
	}
} );

No origin/source check. store.steampowered.com sets frame-ancestors 'none' (can't be iframed) but no Cross-Origin-Opener-Policy, so a window.open() popup retains a scriptable cross-origin opener relationship -- enough to reach this listener.

Proof of concept (live-verified)

Loaded the real unpacked extension in Chrome via Puppeteer/CDP, mapping store.steampowered.com and an unrelated attacker.example to local fixtures, observed the real background service worker's chrome.storage.local:

// on https://attacker.example/
window.__popup = window.open('https://store.steampowered.com/', 'victim');
window.__popup.postMessage({ type: 'steamdb:extension-invalidate-cache' }, '*');

BEFORE: {"userdata.cached":111111,"userfamilydata":"{\"seed\":true}"}
AFTER:  {"userdata.cached":1789393938791,"userfamilydata":"{}"}
CACHE WAS INVALIDATED BY FORGED CROSS-ORIGIN MESSAGE

Impact

Low: only reachable privileged action is InvalidateCache() -- forces re-fetch of the user's own dynamicstore/userdata endpoint, minor nuisance DoS + transient loss of "already owned" highlighting. No data exfiltration (fetch targets Steam's own endpoint with credentials, response never reaches the attacker). No other contentScriptQuery is reachable through this listener.

Suggested fix

window.addEventListener( 'message', ( request ) =>
{
	if( request.source !== window || request.origin !== window.location.origin )
	{
		return;
	}
	if( request?.data && request.data.type === 'steamdb:extension-invalidate-cache' )
	{
		...

Mirrors the already-correct pattern in scripts/steamdb/global.js; the MAIN-world sender already targets window.location.origin explicitly, so this has no functional downside.

---

This report was produced with AI assistance (Claude, Anthropic): manifest review, source tracing, and a live end-to-end Puppeteer/CDP proof-of-concept against the real unpacked extension.