25 lines
794 B
JavaScript
25 lines
794 B
JavaScript
// Vestibule blocked page — shown when a top-level navigation is
|
|
// denied by the URL policy (safelist mode).
|
|
//
|
|
// The attempted URL arrives as the ?u= query parameter. Only the
|
|
// hostname is displayed, and only via textContent — the parameter is
|
|
// never written into the DOM as markup.
|
|
|
|
(() => {
|
|
const params = new URLSearchParams(location.search);
|
|
const attempted = params.get("u") || "";
|
|
|
|
let host = attempted;
|
|
try {
|
|
host = new URL(attempted).hostname;
|
|
} catch (e) {
|
|
/* unparsable — display the raw value; textContent makes it inert */
|
|
}
|
|
|
|
document.getElementById("block-domain").textContent = host;
|
|
|
|
document.getElementById("btn-home").addEventListener("click", () => {
|
|
browser.runtime.sendMessage({ type: "navigate-home" }).catch(() => {});
|
|
});
|
|
})();
|