Ensure message correctness in extension (#1907)

* Ensure we check isFeatureEnabled correctly

* Only trigger updates on listenForUpdateChanges enabled features (CTL)

* Add bail out option for invalid messages

Author: jonathanKingston

injected/entry-points/extension-mv3.js

@@ -27,6 +27,10 @@ window.addEventListener(secret, ({ detail: encodedMessage }) => {
         case 'register':
             if (message.argumentsObject) {
                 message.argumentsObject.messageSecret = secret;
+                if (!message.argumentsObject?.site?.enabledFeatures) {
+                    // Potentially corrupted site object, don't init
+                    return;
+                }
                 init(message.argumentsObject);
             }
             break;

injected/src/content-feature.js

@@ -36,6 +36,12 @@ export default class ContentFeature extends ConfigFeature {
      */
     listenForUrlChanges = false;
 
+    /**
+     * Set this to true if you wish to get update calls (legacy).
+     * @type {boolean}
+     */
+    listenForUpdateChanges = false;
+
     /** @type {ImportMeta} */
     #importConfig;
 

injected/src/content-scope-features.js

@@ -116,7 +116,7 @@ function alwaysInitExtensionFeatures(args, featureName) {
 async function updateFeaturesInner(args) {
     const resolvedFeatures = await Promise.all(features);
     resolvedFeatures.forEach(({ featureInstance, featureName }) => {
-        if (!isFeatureBroken(initArgs, featureName) && featureInstance.update) {
+        if (!isFeatureBroken(initArgs, featureName) && featureInstance.listenForUpdateChanges) {
             featureInstance.update(args);
         }
     });

injected/src/features/click-to-load.js

@@ -1778,6 +1778,8 @@ export default class ClickToLoad extends ContentFeature {
     /** @type {MessagingContext} */
     #messagingContext;
 
+    listenForUpdateChanges = true;
+
     async init(args) {
         /**
          * Bail if no messaging backend - this is a debugging feature to ensure we don't

injected/src/utils.js

@@ -246,10 +246,20 @@ export function iterateDataKey(key, callback) {
     }
 }
 
+/**
+ * Check if a feature is considered broken/disabled for the current site
+ * @param {import('./content-scope-features.js').LoadArgs} args - Configuration arguments containing site information
+ * @param {string} feature - The feature name to check
+ * @returns {boolean} True if the feature is broken/disabled, false if it should be enabled
+ */
 export function isFeatureBroken(args, feature) {
-    return isPlatformSpecificFeature(feature)
-        ? !args.site.enabledFeatures.includes(feature)
-        : args.site.isBroken || args.site.allowlisted || !args.site.enabledFeatures.includes(feature);
+    const isFeatureEnabled = args.site.enabledFeatures?.includes(feature) ?? false;
+
+    if (isPlatformSpecificFeature(feature)) {
+        return !isFeatureEnabled;
+    }
+
+    return args.site.isBroken || args.site.allowlisted || !isFeatureEnabled;
 }
 
 export function camelcase(dashCaseText) {