Reestruturação dos arquivos e pastas do código da extensão

page-bridge.js

@@ -10,6 +10,12 @@
   const EXTRA_CAPTURE_ORIGINS = new Set([
     "https://comcipapic-oalprod.integration.ocp.oraclecloud.com",
   ]);
+  const ALLOWED_TOP_MESSAGE_ORIGINS = new Set([
+    "https://eeho.fa.us2.oraclecloud.com",
+    "https://spa.oracle.com",
+  ]);
+  const AUTH_STORAGE_HINT_PATTERN =
+    /(authorization|token|wwb|wlwb|provider|spa-ts|spats)/i;
   const SAFE_HEADER_BLOCKLIST = new Set([
     "accept-encoding",
     "accept-language",
@@ -48,6 +54,51 @@
     }
   }
 
+  function getAllowedTopMessageOrigin() {
+    const candidates = [];
+
+    try {
+      const referrerOrigin = document.referrer
+        ? new URL(document.referrer).origin
+        : "";
+
+      if (referrerOrigin) {
+        candidates.push(referrerOrigin);
+      }
+    } catch {
+      // Referrer parsing is best-effort; fall back to ancestorOrigins/current origin.
+    }
+
+    try {
+      const ancestorOrigins = Array.from(window.location?.ancestorOrigins || []);
+      candidates.push(...ancestorOrigins);
+    } catch {
+      // ancestorOrigins is browser-specific and may be unavailable.
+    }
+
+    if (window.top === window) {
+      candidates.push(getSafeTargetOrigin());
+    }
+
+    for (const origin of candidates) {
+      if (ALLOWED_TOP_MESSAGE_ORIGINS.has(origin)) {
+        return origin;
+      }
+    }
+
+    return "";
+  }
+
+  function safePostToTop(payload) {
+    const targetOrigin = getAllowedTopMessageOrigin();
+
+    if (!targetOrigin) {
+      return false;
+    }
+
+    return safePostMessage(payload, window.top, targetOrigin);
+  }
+
   const nativeFetch = window.fetch.bind(window);
   const originalOpen = window.XMLHttpRequest.prototype.open;
   const originalSetRequestHeader = window.XMLHttpRequest.prototype.setRequestHeader;
@@ -215,15 +266,13 @@
       return;
     }
 
-    safePostMessage(
+    safePostToTop(
       {
         source: MESSAGE_SOURCE,
         type: "ARCH_PANEL_WORKBENCH_AUTH_HEADERS",
         url: normalizeUrl(url),
         headers: authHeaders,
-      },
-      window.top,
-      "*"
+      }
     );
   }
 
@@ -356,7 +405,7 @@
           const key = storage.key(index) || "";
           const value = storage.getItem(key) || "";
 
-          if (key || value) {
+          if (isAuthStorageCandidate(key, value)) {
             candidates.push([key, value]);
           }
         }
@@ -372,6 +421,25 @@
     return headers;
   }
 
+  function isAuthStorageCandidate(key, value) {
+    const normalizedKey = String(key || "");
+    const normalizedValue = String(value || "").trim();
+
+    if (!normalizedKey && !normalizedValue) {
+      return false;
+    }
+
+    if (AUTH_STORAGE_HINT_PATTERN.test(normalizedKey)) {
+      return true;
+    }
+
+    if (looksLikeJwt(normalizedValue)) {
+      return true;
+    }
+
+    return AUTH_STORAGE_HINT_PATTERN.test(normalizedValue);
+  }
+
   function collectAuthFromStorageEntry(headers, key, value) {
     const normalizedKey = String(key || "").toLowerCase();
     const normalizedValue = String(value || "").trim();