Fix: Add message sender validation to service worker and offscreen message handlers

[Copilot]

The chrome.runtime.onMessage handlers in both the service worker and offscreen document accepted messages from any sender, allowing content scripts running in arbitrary web page contexts to trigger sensitive operations like START_GOOGLE_AUTH and UPLOAD_ASSET.

Changes

• src/background/service-worker.ts

  • Reject all messages where sender.id !== chrome.runtime.id
  • Additionally gate START_GOOGLE_AUTH and UPLOAD_ASSET behind a sender.tab check — these operations are only permitted from extension pages (popup/options), not content scripts

• src/offscreen/offscreen.ts

  • Same sender.id guard applied to the offscreen message handler

chrome.runtime.onMessage.addListener((message: ExtensionMessage, sender, sendResponse) => {
  if (sender.id !== chrome.runtime.id) {
    sendResponse({ success: false, error: 'Unauthorized sender' });
    return false;
  }

  // ...

  case 'START_GOOGLE_AUTH':
    if (sender.tab) {
      sendResponse({ success: false, error: 'Unauthorized sender' });
      return false;
    }
    // proceed with auth

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Security][Critical] No message sender validation in service worker message handler</issue_title>
<issue_description>## Summary

The service worker's chrome.runtime.onMessage handler accepts messages from any sender without verifying sender.id or sender.origin. This allows a compromised content script (running in a web page context) to trigger sensitive operations such as START_GOOGLE_AUTH, UPLOAD_ASSET, or CAPTURE_SCREENSHOT.

Affected Files

• src/background/service-worker.ts, line 94-151 — Main message handler ignores _sender parameter entirely
• src/offscreen/offscreen.ts, line 29-47 — Offscreen message handler also ignores sender

Details

The SELECTION_COMPLETE handler (line 141-145) accepts arbitrary payload data from any content script without validation. The content script at src/content/selection-overlay.ts runs in web page contexts and sends messages to the background, meaning the attack surface includes any web page the user visits.

// service-worker.ts line 94 — No sender validation
chrome.runtime.onMessage.addListener((message: ExtensionMessage, _sender, sendResponse) => {
  switch (message.type) {
    case 'CAPTURE_SCREENSHOT': ...
    case 'UPLOAD_ASSET': ...
    case 'START_GOOGLE_AUTH': ...
    case 'SELECTION_COMPLETE': ...

Suggested Fix

1. Validate sender.id === chrome.runtime.id for all messages
2. For sensitive operations (START_GOOGLE_AUTH, UPLOAD_ASSET), verify the sender is an extension page (no sender.tab) rather than a content script
3. Apply the same validation to the offscreen document handler

chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (sender.id !== chrome.runtime.id) return;
  if (['START_GOOGLE_AUTH', 'UPLOAD_ASSET'].includes(message.type)) {
    if (sender.tab) {
      sendResponse({ success: false, error: 'Unauthorized sender' });
      return;
    }
  }
  // ... handle message
});

Impact

A compromised or malicious content script could initiate OAuth flows, upload arbitrary assets, or trigger screenshots without user consent.

Generated by Health Monitor with Omni</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Security][Critical] No message sender validation in service worker message handler #19

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.