fix: 清理跨站动态快照

Author: setube

package.json

@@ -1,7 +1,7 @@
 {
   "name": "stackprism",
   "private": true,
-  "version": "1.2.73",
+  "version": "1.2.74",
   "type": "module",
   "description": "StackPrism 用于检测网页前端、后端、CDN、SaaS、广告营销、统计、登录、支付、网站程序和主题模板线索。",
   "scripts": {

src/background/dynamic-snapshot.ts

@@ -58,6 +58,20 @@ const buildDynamicSnapshotSignature = snapshot =>
     ...snapshot.domMarkers
   ].join('\n')
 
+const getUrlOrigin = value => {
+  try {
+    return new URL(String(value || '')).origin
+  } catch {
+    return ''
+  }
+}
+
+const snapshotMatchesTabOrigin = (snapshot, tabUrl) => {
+  const snapshotOrigin = getUrlOrigin(snapshot?.url)
+  const tabOrigin = getUrlOrigin(tabUrl)
+  return !snapshotOrigin || !tabOrigin || snapshotOrigin === tabOrigin
+}
+
 const isLikelyDynamicLibraryFileName = name => {
   if (!name || name.length < 2 || name.length > 60) {
     return false
@@ -647,6 +661,9 @@ const processQueuedDynamicSnapshot = async tabId => {
     clearBadge(tabId)
     return
   }
+  if (!snapshotMatchesTabOrigin(snapshot, tab.url)) {
+    return
+  }
 
   const [data, rules, settings] = await Promise.all([getTabData(tabId), loadTechRules(), loadDetectorSettings()])
   data.dynamic = normalizeDynamicSnapshot(snapshot, buildEffectivePageRules(rules.page || {}, settings), data.dynamic)

src/background/index.ts

@@ -37,6 +37,22 @@ const clearTabDetectionState = (tabId: number) => {
   clearTabSession(tabId).catch(() => {})
 }
 
+const getUrlOrigin = (value: unknown): string => {
+  try {
+    return new URL(String(value || '')).origin
+  } catch {
+    return ''
+  }
+}
+
+const clearCrossOriginDynamicSnapshot = (data: any, nextUrl: string) => {
+  const dynamicOrigin = getUrlOrigin(data?.dynamic?.url)
+  const nextOrigin = getUrlOrigin(nextUrl)
+  if (dynamicOrigin && nextOrigin && dynamicOrigin !== nextOrigin) {
+    delete data.dynamic
+  }
+}
+
 chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
   const url = changeInfo.url || tab.url || ''
   if (url && !isDetectablePageUrl(url)) {
@@ -85,6 +101,7 @@ chrome.webRequest.onHeadersReceived.addListener(
         }
         const record = buildHeaderRecord(details, rules.headers || {}, settings)
         if (details.type === 'main_frame') {
+          clearCrossOriginDynamicSnapshot(data, details.url)
           data.main = shouldMergeHeaderRecords(data.main, record) ? mergeHeaderRecords(data.main, record) : record
           data.apis = []
           data.frames = []