From 7d18376cf2983fae100203368462506c68bda1fd Mon Sep 17 00:00:00 2001
From: tophf <tophf@gmx.com>
Date: Sun, 8 Nov 2020 13:29:15 +0300
Subject: [PATCH] always use deepCopy for prefs.values for safety

---
 background/background.js | 2 +-
 js/prefs.js              | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/background/background.js b/background/background.js
index 109123f2..d90a63be 100644
--- a/background/background.js
+++ b/background/background.js
@@ -59,7 +59,7 @@ window.API_METHODS = Object.assign(window.API_METHODS || {}, {
   parseCss({code}) {
     return backgroundWorker.parseMozFormat({code});
   },
-  getPrefs: () => prefs.values, // will be deepCopy'd by invokeAPI handler
+  getPrefs: () => prefs.values,
   setPref: (key, value) => prefs.set(key, value),
 
   openEditor,
diff --git a/js/prefs.js b/js/prefs.js
index c3f19485..cba6e0d9 100644
--- a/js/prefs.js
+++ b/js/prefs.js
@@ -137,7 +137,9 @@ window.INJECTED !== 1 && (() => {
   const prefs = window.prefs = {
     initializing,
     defaults,
-    values,
+    get values() {
+      return deepCopy(values);
+    },
     get(key) {
       return isKnown(key) && values[key];
     },