From dd08def78e1585e09e313531d975142b329cc236 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 15 Aug 2026 18:40:52 +0000 Subject: [PATCH 1/3] fix: add noopener to pop-out window Add noopener flag to window.open() call to prevent popup from retaining window.opener reference. Reduces blast radius of potential XSS exploits. Closes #25. Co-Authored-By: Claude Haiku 4.5 Claude-Session: https://claude.ai/code/session_01VbjTstU2uH8W1bQ8S3VrF7 --- screen.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/screen.js b/screen.js index 6b2ebe9..fc021a0 100644 --- a/screen.js +++ b/screen.js @@ -3171,7 +3171,7 @@ try { sp.set('detectVerifierOffsetMs', String(cfg.detectVerifierOffsetMs || 0)); if (Number.isFinite(cfg.mastery)) sp.set('mastery', String(cfg.mastery)); - const popup = window.open(url.toString(), popupId, 'popup,width=1280,height=420'); + const popup = window.open(url.toString(), popupId, 'popup,width=1280,height=420,noopener'); if (!popup) { _showMainToast('Pop-out blocked by the browser. Allow popups for this site and try again.'); return; From 6d164ff514aac30a95fc920766607f946a57b4ad Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 15 Aug 2026 18:47:39 +0000 Subject: [PATCH 2/3] chore: bump version to 1.14.3 for security fix --- plugin.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugin.json b/plugin.json index e67a97c..ec7eeb9 100644 --- a/plugin.json +++ b/plugin.json @@ -1,7 +1,7 @@ { "id": "splitscreen", "name": "Split Screen", - "version": "1.14.2", + "version": "1.14.3", "private": false, "standards": ["plugin-runtime-idempotent.v1"], "settings": { From babc67b8faff702a819b3cb7bb3e2d55bf774c44 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 15 Aug 2026 18:49:09 +0000 Subject: [PATCH 3/3] Revert "fix: add noopener to pop-out window" This commit reverts dd08def. Issue #25 (prevent pop-out window from retaining window.opener) does not apply to this code: 1. The popup URL is same-origin (built from window.location.origin) 2. There are no window.opener references in either main or popup side 3. The popup tracking and reaping logic requires the returned popup reference The noopener feature makes window.open() return null per HTML spec, breaking the entire pop-out feature (popup opens but tracking fails). This resolves the regression found in Pullfrog review. --- screen.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/screen.js b/screen.js index fc021a0..6b2ebe9 100644 --- a/screen.js +++ b/screen.js @@ -3171,7 +3171,7 @@ try { sp.set('detectVerifierOffsetMs', String(cfg.detectVerifierOffsetMs || 0)); if (Number.isFinite(cfg.mastery)) sp.set('mastery', String(cfg.mastery)); - const popup = window.open(url.toString(), popupId, 'popup,width=1280,height=420,noopener'); + const popup = window.open(url.toString(), popupId, 'popup,width=1280,height=420'); if (!popup) { _showMainToast('Pop-out blocked by the browser. Allow popups for this site and try again.'); return;