Injected passkeys.js is leaking its variables and functions to the site

[xPaw]

Its injected here:

keepassxc-browser/keepassxc-browser/content/keepassxc-browser.js

Lines 872 to 874 in 60355e8

	const passkeys = document.createElement('script');
	passkeys.src = browser.runtime.getURL('content/passkeys.js');
	document.documentElement.appendChild(passkeys);

As a result, all of its variables are just readable by the site, easy enough to confirm with console:

[droidmonkey]

See #2432

That's how passkeys work due to the need to override browser functions

[varjolintu]

There's no way to prevent this. The site must find the script and its contents.

[xPaw]

This isn't entirely true because you can put all of the consts and functions into the (async () => { scope so that they don't leak globally.

[varjolintu]

@xPaw If that's true, then I'll have to inspect this further.