Extend event-based add-on implementation.

firefox/login@nameid.org/content/NameIdAddon.js

@@ -121,13 +121,14 @@ NameIdAddon.prototype =
 
       /* Register custom event handler.  */
       var me = this;
+      var url = stripUrl (doc.URL);
       function handler ()
         {
           var data = apiEl.getAttribute ("data");
           var res;
           try
             {
-              res = me.handleCall (doc.URL, JSON.parse (data));
+              res = me.handleCall (url, JSON.parse (data));
               res.success = true;
             }
           catch (err)
@@ -156,6 +157,12 @@ NameIdAddon.prototype =
       switch (data.method)
         {
         case "signChallenge":
+          if (url !== data.url)
+            {
+              log ("URL mismatch: expected '" + url
+                    + "', got '" + data.url + "'");
+              throw "Login page URL mismatch.";
+            }
           var signature = this.signChallenge (url, data.nonce, data.identity);
           return {"signature": signature};
 

firefox/login@nameid.org/content/TrustManager.js

@@ -54,11 +54,7 @@ TrustManager.prototype =
     {
       /* Remove request parameters from the URL, since they may depend on
          the consumer site for instance.  */
-      var re = /^([^?]*)\?/;
-      var arr = re.exec (url);
-      if (arr)
-        url = arr[1];
-
+      url = stripUrl (url);
       log ("Deciding trust for " + url + "...");
 
       var white = this.pref.getTrustList ("white");

firefox/login@nameid.org/content/Utils.js

 /*
     NameID, a namecoin based OpenID identity provider.
-    Copyright (C) 2013 by Daniel Kraft <d@domob.eu>
+    Copyright (C) 2013-2014 by Daniel Kraft <d@domob.eu>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -20,7 +20,7 @@
 
 Components.utils.import ("resource://gre/modules/Services.jsm");
 
-var EXPORTED_SYMBOLS = ["log", "logError", "assert"];
+var EXPORTED_SYMBOLS = ["log", "logError", "assert", "stripUrl"];
 
 /**
  * Utility function to log a message to the ErrorConsole.  This is used
@@ -55,3 +55,19 @@ function assert (cond)
       throw "Assertion failure.";
     }
 }
+
+/**
+ * Strip request parameters off an URL.  This is used to get the login
+ * page URL for the challenge message.
+ * @param url Original URL.
+ * @return URL without request parameters.
+ */
+function stripUrl (url)
+{
+  var re = /^([^?]*)\?/;
+  var arr = re.exec (url);
+  if (arr)
+    return arr[1];
+
+  return url;
+}