From b8d2c84e6eb05c5faa2db4fb8df45eabea88ba3d Mon Sep 17 00:00:00 2001
From: Satanas1275 <107134873+Satanas1275@users.noreply.github.com>
Date: Thu, 2 Jul 2026 00:08:37 +0200
Subject: [PATCH] fix: replace postMessage wildcard '*' with
 window.location.origin

All 18 window.postMessage(..., '*') calls across the codebase now
use window.location.origin as the targetOrigin:

- src/utils/extensionProxy.ts: EXTENSION_REQUEST message
- extension/Chrome/injected.js: 4 message helpers (extract, extractAll, detect, setupHeaders)
- extension/Chrome/content.js: 4 response forwards (error/success/catch + EXTRACTION_RESULT)
- extension/Firefox/injected.js: 4 message helpers (mirror of Chrome)
- extension/Firefox/content.js: 4 response forwards (mirror of Chrome)
- userscript/movix.user.js: postExtensionResponse call

This prevents any cross-origin script (iframe, rogue extension, etc.)
from intercepting Movix extension messages.
---
 extension/Chrome/content.js   | 8 ++++----
 extension/Chrome/injected.js  | 8 ++++----
 extension/Firefox/content.js  | 8 ++++----
 extension/Firefox/injected.js | 8 ++++----
 src/utils/extensionProxy.ts   | 2 +-
 userscript/movix.user.js      | 2 +-
 6 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/extension/Chrome/content.js b/extension/Chrome/content.js
index a3d897e..8e7bd3c 100644
--- a/extension/Chrome/content.js
+++ b/extension/Chrome/content.js
@@ -26,14 +26,14 @@ window.addEventListener("message", async (event) => {
                     messageId,
                     success: false,
                     error: response.error
-                }, "*");
+                }, window.location.origin);
             } else {
                 window.postMessage({
                     source: "MOVIX_EXTENSION",
                     messageId,
                     success: true,
                     data: response
-                }, "*");
+                }, window.location.origin);
             }
         } catch (error) {
             window.postMessage({
@@ -41,7 +41,7 @@ window.addEventListener("message", async (event) => {
                 messageId,
                 success: false,
                 error: error.message
-            }, "*");
+            }, window.location.origin);
         }
     }
 });
@@ -55,6 +55,6 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
             source: 'MOVIX_EXTENSION',
             type: 'EXTRACTION_RESULT',
             data: message.data
-        }, '*');
+        }, window.location.origin);
     }
 });
diff --git a/extension/Chrome/injected.js b/extension/Chrome/injected.js
index 576320e..cd1446e 100644
--- a/extension/Chrome/injected.js
+++ b/extension/Chrome/injected.js
@@ -38,7 +38,7 @@ window.movixExtractM3u8 = function(type, url) {
             action: 'EXTRACT_M3U8',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -77,7 +77,7 @@ window.movixExtractAllM3u8 = function(sources) {
             action: 'EXTRACT_ALL_M3U8',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -106,7 +106,7 @@ window.movixDetectEmbeds = function(sources) {
             action: 'DETECT_EMBEDS',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -134,6 +134,6 @@ window.movixSetupHeaders = function(type, url) {
             action: 'SETUP_HEADERS',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
diff --git a/extension/Firefox/content.js b/extension/Firefox/content.js
index dd5afe0..dd21042 100644
--- a/extension/Firefox/content.js
+++ b/extension/Firefox/content.js
@@ -29,14 +29,14 @@ window.addEventListener("message", async (event) => {
                     messageId,
                     success: false,
                     error: response.error
-                }, "*");
+                }, window.location.origin);
             } else {
                 window.postMessage({
                     source: "MOVIX_EXTENSION",
                     messageId,
                     success: true,
                     data: response
-                }, "*");
+                }, window.location.origin);
             }
         } catch (error) {
             window.postMessage({
@@ -44,7 +44,7 @@ window.addEventListener("message", async (event) => {
                 messageId,
                 success: false,
                 error: error.message
-            }, "*");
+            }, window.location.origin);
         }
     }
 });
@@ -57,6 +57,6 @@ browserAPI.runtime.onMessage.addListener((message, sender, sendResponse) => {
             source: 'MOVIX_EXTENSION',
             type: 'EXTRACTION_RESULT',
             data: message.data
-        }, '*');
+        }, window.location.origin);
     }
 });
diff --git a/extension/Firefox/injected.js b/extension/Firefox/injected.js
index 659067e..8908544 100644
--- a/extension/Firefox/injected.js
+++ b/extension/Firefox/injected.js
@@ -38,7 +38,7 @@ window.movixExtractM3u8 = function(type, url) {
             action: 'EXTRACT_M3U8',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -77,7 +77,7 @@ window.movixExtractAllM3u8 = function(sources) {
             action: 'EXTRACT_ALL_M3U8',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -106,7 +106,7 @@ window.movixDetectEmbeds = function(sources) {
             action: 'DETECT_EMBEDS',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -134,6 +134,6 @@ window.movixSetupHeaders = function(type, url) {
             action: 'SETUP_HEADERS',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
diff --git a/src/utils/extensionProxy.ts b/src/utils/extensionProxy.ts
index 310610d..e30463d 100644
--- a/src/utils/extensionProxy.ts
+++ b/src/utils/extensionProxy.ts
@@ -60,7 +60,7 @@ export const fetchFromExtension = <T = unknown>(
             action,
             payload: enrichedPayload,
             messageId
-        }, "*");
+        }, window.location.origin);
 
         // Timeout after 10 seconds
         setTimeout(() => {
diff --git a/userscript/movix.user.js b/userscript/movix.user.js
index a78254a..ce072fc 100644
--- a/userscript/movix.user.js
+++ b/userscript/movix.user.js
@@ -5153,7 +5153,7 @@
                 ? payload.message
                 : payload?.error || String(payload || "Erreur inconnue"),
           },
-      "*",
+      pageWindow.location.origin,
     );
   }