search

chatziko / location-guard

Hide your geographic location from websites.
411 stars 67 forks source link

Extension bypass #98

Open NDevTK opened 2 years ago

NDevTK commented 2 years ago

Page scripts can not be trusted to not use the native APIs. navigator.geolocation.getCurrentPosition = navigator.geolocation.__proto__.getCurrentPosition

Maybe the API can be blocked for websites by using https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

Ideally the API and permission checks would be done in the background page so site isolation applys.

I may be missing something so pls do correct me :)

woshiguabi commented 1 year ago

Geolocation.prototype.getCurrentPosition.call(navigator.geolocation, console.log) A simple bypass. Maybe should be overridden on the prototype.

NDevTK commented 1 year ago

I think its not simple but there is a project: https://github.com/LavaMoat/snow For site isolation its probably better to embed an iframe of an extension page and have that request the geolocation permission. (After confirming with the user)