From 1ced9aafc00c10992bab8bd3f1b6b1397f05b7b9 Mon Sep 17 00:00:00 2001
From: toasted-nutbread <toasted-nutbread@users.noreply.github.com>
Date: Tue, 19 Dec 2023 00:33:38 -0500
Subject: Make JSON.parse usage safer (#373)

* Make JSON.parse usage safer

* Fix any type

* Add readResponseJson

* Use readResponseJson

* Additional updates

* Rename files

* Add types
---
 ext/js/comm/api.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to 'ext/js/comm/api.js')

diff --git a/ext/js/comm/api.js b/ext/js/comm/api.js
index 35a66d9e..43f707e2 100644
--- a/ext/js/comm/api.js
+++ b/ext/js/comm/api.js
@@ -18,6 +18,7 @@
 
 import {deferPromise} from '../core.js';
 import {ExtensionError} from '../core/extension-error.js';
+import {parseJson} from '../core/json.js';
 
 export class API {
     /**
@@ -433,6 +434,7 @@ export class API {
         return new Promise((resolve, reject) => {
             /** @type {?import('core').Timeout} */
             let timer = null;
+            /** @type {import('core').DeferredPromiseDetails<import('api').CreateActionPortResult>} */
             const portDetails = deferPromise();
 
             /**
@@ -441,8 +443,9 @@ export class API {
             const onConnect = async (port) => {
                 try {
                     const {name: expectedName, id: expectedId} = await portDetails.promise;
-                    const {name, id} = JSON.parse(port.name);
-                    if (name !== expectedName || id !== expectedId || timer === null) { return; }
+                    /** @type {import('cross-frame-api').PortDetails} */
+                    const portDetails2 = parseJson(port.name);
+                    if (portDetails2.name !== expectedName || portDetails2.id !== expectedId || timer === null) { return; }
                 } catch (e) {
                     return;
                 }
@@ -470,7 +473,9 @@ export class API {
             timer = setTimeout(() => onError(new Error('Timeout')), timeout);
 
             chrome.runtime.onConnect.addListener(onConnect);
-            this._invoke('createActionPort').then(portDetails.resolve, onError);
+            /** @type {Promise<import('api').CreateActionPortResult>} */
+            const createActionPortResult = this._invoke('createActionPort');
+            createActionPortResult.then(portDetails.resolve, onError);
         });
     }
 
-- 
cgit v1.2.3