#8219: don't let frames control sidebar

src/contentScript/contentScriptCore.ts

@@ -55,6 +55,7 @@ import { markDocumentAsFocusableByUser } from "@/utils/focusTracker";
 import contentScriptPlatform from "@/contentScript/contentScriptPlatform";
 import axios from "axios";
 import { initDeferredLoginController } from "@/contentScript/integrations/deferredLoginController";
+import { isLoadedInIframe } from "@/utils/iframeUtils";
 
 setPlatform(contentScriptPlatform);
 
@@ -101,8 +102,11 @@ export async function init(): Promise<void> {
   initSidebarFocusEvents();
   void initSidebarActivation();
 
-  // Update `sidePanel`
-  void renderPanelsIfVisible();
+  if (!isLoadedInIframe()) {
+    // FIXME: do we want to do this? It will cause the panels to be reset on non-SPA navigation/reload
+    // Update `sidePanel`
+    void renderPanelsIfVisible();
+  }
 
   // Let the partner page know
   initPartnerIntegrations();

src/contentScript/sidebarController.tsx

@@ -210,6 +210,11 @@ export async function updateSidebar(
 export async function renderPanelsIfVisible(): Promise<void> {
   expectContext("contentScript");
 
+  if (isLoadedInIframe()) {
+    console.warn("renderPanelsIfVisible should not be called from a frame");
+    return;
+  }
+
   if (await isSidePanelOpen()) {
     void sidebarInThisTab.renderPanels(getTimedSequence(), panels);
   } else {
@@ -298,6 +303,11 @@ export function removeExtensions(extensionIds: UUID[]): void {
 
   console.debug("sidebarController:removeExtensions", { extensionIds });
 
+  // Avoid unnecessary messaging. Also, prevent issues if this method is called as cleanup from a frame
+  if (extensionIds.length === 0) {
+    return;
+  }
+
   // `panels` is const, so replace the contents
   const current = panels.splice(0);
   panels.push(...current.filter((x) => !extensionIds.includes(x.extensionId)));

src/utils/iframeUtils.ts

@@ -19,9 +19,12 @@
  * Returns true if this function is called within an IFrame
  */
 
-export const isLoadedInIframe = () => {
+export const isLoadedInIframe = (): boolean => {
   // Using a try/catch block because in some cases trying to
   // access window.top from an iframe can result in a SecurityError
+
+  // If updating this method to use the messenger/frameId, remember that frameId === 0 only for the active top-level
+  // frame: see https://developer.chrome.com/blog/extension-instantnav
   try {
     return window.self !== window.top;
   } catch {