Firefox port #16

zethash · 2021-11-07T09:44:56Z

If anything - breaks backward compatibility, so add in a separate branch

cubic-dev-ai

8 issues found across 12 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="scripts/background.js">

<violation number="1" location="scripts/background.js:1">
P1: This will throw in environments where `browser` is undefined (e.g., Chrome), preventing the background script from loading. Use a safe fallback to the existing `chrome` global.</violation>

<violation number="2" location="scripts/background.js:12">
P2: Declare `sourceUrl` with `const`/`let` to avoid leaking a global variable into the background script scope.</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:16">
P3: Fix the spelling of “Temporaty” to “Temporary” in the installation heading for clarity.</violation>

<violation number="2" location="README.md:18">
P3: Correct the spelling of “temporaty” to “temporary” in the add-on installation step.</violation>
</file>

<file name="scripts/exp.js">

<violation number="1" location="scripts/exp.js:1">
P2: Guard against `browser` being undefined; this line throws in Chrome, breaking existing extension usage. Use a conditional alias instead of directly referencing `browser`.</violation>
</file>

<file name="scripts/utils.js">

<violation number="1" location="scripts/utils.js:112">
P2: Guard against missing `originUrl` before calling `new URL(...)`. `originUrl` is optional for webRequest details, so `new URL(initiator)` can throw and stop scanning for requests without an origin.</violation>
</file>

<file name="scripts/popup.js">

<violation number="1" location="scripts/popup.js:1">
P1: Directly assigning `browser` breaks Chrome because `browser` is undefined there. Use a guarded fallback so Chrome continues to work.</violation>
</file>

<file name="scripts/content_script.js">

<violation number="1" location="scripts/content_script.js:1">
P2: Unconditionally assigning `browser` to `chrome` will throw in Chrome where `browser` is undefined, breaking the content script. Use a guarded assignment that falls back to `chrome` when `browser` isn’t available.</violation>
</file>

Since this is your first cubic review, here's how it works:

cubic automatically reviews your code and comments on bugs and improvements
Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/background.js

@@ -1,3 +1,5 @@
+var chrome = browser;


P1: This will throw in environments where browser is undefined (e.g., Chrome), preventing the background script from loading. Use a safe fallback to the existing chrome global.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/background.js, line 1: <comment>This will throw in environments where `browser` is undefined (e.g., Chrome), preventing the background script from loading. Use a safe fallback to the existing `chrome` global.</comment> <file context> @@ -1,3 +1,5 @@ +var chrome = browser; + const databaseUrl = chrome.extension.getURL('/database.csv'); </file context>

Suggested change

var chrome = browser;

var chrome = typeof browser !== 'undefined' ? browser : globalThis.chrome;

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/popup.js

@@ -1,4 +1,6 @@
-var port = chrome.extension.connect({
+var chrome = browser;


P1: Directly assigning browser breaks Chrome because browser is undefined there. Use a guarded fallback so Chrome continues to work.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/popup.js, line 1: <comment>Directly assigning `browser` breaks Chrome because `browser` is undefined there. Use a guarded fallback so Chrome continues to work.</comment> <file context> @@ -1,4 +1,6 @@ -var port = chrome.extension.connect({ +var chrome = browser; + +var port = chrome.runtime.connect({ </file context>

Suggested change

var chrome = browser;

var chrome = typeof browser !== "undefined" ? browser : window.chrome;

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/background.js

 /* setup listeners */
 chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
-    found.add(msg);
+    sourceUrl = new URL(msg);


P2: Declare sourceUrl with const/let to avoid leaking a global variable into the background script scope.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/background.js, line 12: <comment>Declare `sourceUrl` with `const`/`let` to avoid leaking a global variable into the background script scope.</comment> <file context> @@ -7,11 +9,12 @@ setBadgeCount(0); /* setup listeners */ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => { - found.add(msg); + sourceUrl = new URL(msg); + found.add(JSON.stringify({ domain: sourceUrl.origin, type: 'Active Mode', file: sourceUrl.href, lineCol: 0 })); setBadgeCount(found.size); </file context>

Suggested change

sourceUrl = new URL(msg);

const sourceUrl = new URL(msg);

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/exp.js

@@ -1,3 +1,5 @@
+var chrome = browser;


P2: Guard against browser being undefined; this line throws in Chrome, breaking existing extension usage. Use a conditional alias instead of directly referencing browser.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/exp.js, line 1: <comment>Guard against `browser` being undefined; this line throws in Chrome, breaking existing extension usage. Use a conditional alias instead of directly referencing `browser`.</comment> <file context> @@ -1,3 +1,5 @@ +var chrome = browser; + var PAYLOADS = [ </file context>

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/utils.js

                }
-
-                found.add(JSON.stringify({ domain: initiator, type: name, file: requestUri, lineCol }))
+                found.add(JSON.stringify({ domain: new URL(initiator).origin, type: name, file: requestUri, lineCol }))


P2: Guard against missing originUrl before calling new URL(...). originUrl is optional for webRequest details, so new URL(initiator) can throw and stop scanning for requests without an origin.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/utils.js, line 112: <comment>Guard against missing `originUrl` before calling `new URL(...)`. `originUrl` is optional for webRequest details, so `new URL(initiator)` can throw and stop scanning for requests without an origin.</comment> <file context> @@ -107,8 +109,7 @@ const check = ({ requestUri, initiator }) => { } - - found.add(JSON.stringify({ domain: initiator, type: name, file: requestUri, lineCol })) + found.add(JSON.stringify({ domain: new URL(initiator).origin, type: name, file: requestUri, lineCol })) setBadgeCount(found.size); }); </file context>

Suggested change

found.add(JSON.stringify({ domain: new URL(initiator).origin, type: name, file: requestUri, lineCol }))

found.add(JSON.stringify({ domain: initiator ? new URL(initiator).origin : url.origin, type: name, file: requestUri, lineCol }))

cubic-dev-ai · 2026-01-20T07:20:55Z

scripts/content_script.js

@@ -1,3 +1,5 @@
+var chrome = browser;


P2: Unconditionally assigning browser to chrome will throw in Chrome where browser is undefined, breaking the content script. Use a guarded assignment that falls back to chrome when browser isn’t available.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/content_script.js, line 1: <comment>Unconditionally assigning `browser` to `chrome` will throw in Chrome where `browser` is undefined, breaking the content script. Use a guarded assignment that falls back to `chrome` when `browser` isn’t available.</comment> <file context> @@ -1,3 +1,5 @@ +var chrome = browser; + document.addEventListener('TriggerBrute', () => { </file context>

Suggested change

var chrome = browser;

var chrome = typeof browser !== "undefined" ? browser : chrome;

cubic-dev-ai · 2026-01-20T07:20:55Z

README.md

+* Clone the repo
+* Temporaty install
+   * In Firefox, go to `about:debugging#/runtime/this-firefox`
+   * Click on "Load temporaty add-on" and select `manifest.json` from the cloned repo folder. 


P3: Correct the spelling of “temporaty” to “temporary” in the add-on installation step.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 18: <comment>Correct the spelling of “temporaty” to “temporary” in the add-on installation step.</comment> <file context> @@ -12,23 +12,19 @@ Client Side Protype pollution Scanner +* Clone the repo +* Temporaty install + * In Firefox, go to `about:debugging#/runtime/this-firefox` + * Click on "Load temporaty add-on" and select `manifest.json` from the cloned repo folder. +* Persistent install + * Build `npm install --global web-ext` & `web-ext build` or `npx web-ext build` </file context>

Suggested change

* Click on "Load temporaty add-on" and select `manifest.json` from the cloned repo folder.

* Click on "Load temporary add-on" and select `manifest.json` from the cloned repo folder.

cubic-dev-ai · 2026-01-20T07:20:55Z

README.md

-</ol>
-
+* Clone the repo
+* Temporaty install


P3: Fix the spelling of “Temporaty” to “Temporary” in the installation heading for clarity.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 16: <comment>Fix the spelling of “Temporaty” to “Temporary” in the installation heading for clarity.</comment> <file context> @@ -12,23 +12,19 @@ Client Side Protype pollution Scanner -</ol> - +* Clone the repo +* Temporaty install + * In Firefox, go to `about:debugging#/runtime/this-firefox` + * Click on "Load temporaty add-on" and select `manifest.json` from the cloned repo folder. </file context>

Suggested change

* Temporaty install

* Temporary install

zethash added 5 commits November 7, 2021 12:18

chore: Remove blank options page and script

a5315ef

feat: Set unicode meta-tag for all html pages

bc5ac95

feat: Remove chrome specific methods, others adaptate

c61942a

docs: Manual for temporary install or build

9edc2fd

chore: Ignore folder with builded ext zips

32f43b5

cubic-dev-ai bot reviewed Jan 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Firefox port #16

Firefox port #16

Uh oh!

zethash commented Nov 7, 2021

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

msrkp Jan 20, 2026

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	var chrome = browser;
	var chrome = typeof browser !== 'undefined' ? browser : globalThis.chrome;

		@@ -1,4 +1,6 @@
		var port = chrome.extension.connect({
		var chrome = browser;

	var chrome = browser;
	var chrome = typeof browser !== "undefined" ? browser : window.chrome;

	found.add(JSON.stringify({ domain: new URL(initiator).origin, type: name, file: requestUri, lineCol }))
	found.add(JSON.stringify({ domain: initiator ? new URL(initiator).origin : url.origin, type: name, file: requestUri, lineCol }))

	* Click on "Load temporaty add-on" and select `manifest.json` from the cloned repo folder.
	* Click on "Load temporary add-on" and select `manifest.json` from the cloned repo folder.

Firefox port #16

Are you sure you want to change the base?

Firefox port #16

Uh oh!

Conversation

zethash commented Nov 7, 2021

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msrkp Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading

cubic-dev-ai bot Jan 20, 2026 •

edited

Loading