search

sourcegraph / sourcegraph-public-snapshot

Code AI platform with Code Search & Cody
https://sourcegraph.com
Other
10.1k stars 1.29k forks source link

Bitbucket native integration doesn't prevent browser extension injection #4786

Closed lguychard closed 5 years ago

lguychard commented 5 years ago

Steps to reproduce:

  1. Grant the browser extension permissions on bitbucket.sgdev.org
  2. Visit https://bitbucket.sgdev.org/projects/SOUR/repos/vegeta/browse

Expected:

Only the native integration is executed, the browser extension doesn't run.

Actual:

Browser extension and native integration are both running.

lguychard commented 5 years ago

Note: this should be prevented by the injection of a .sourcegraph-app-background by the native integration, but the way the browser extension checks it is racy: https://sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/browser/src/extension/scripts/inject.tsx#L46-52

felixfbecker commented 5 years ago

The link points to a comment saying it's not racy?

lguychard commented 5 years ago

I meant to close this, the comment was added in #4835 after I investigated this further and determined that it was, in fact, not racy - I had been misled by the "Sourcegraph browser extension is running" console log, which is always logged even when the browser extension code bails due to the presence of the native integration.