···44const storage =
55 typeof browser !== "undefined" ? browser.storage.local : chrome.storage.local
6677+// Regular expression to validate the DID format
88+const didRegex = /^did:plc:[a-zA-Z0-9._-]+(:[a-zA-Z0-9._-]+)*$/
99+1010+// Function to validate the DID string
1111+function isValidDID(didString) {
1212+ return didRegex.test(didString)
1313+}
1414+715// Function to get the domain name from the current hostname
816function getDomainName() {
917 const hostname = window.location.hostname
···2634 record.data.includes("did=did:plc:")
2735 )
28362929- // We return the DID if we found one
3030- return didRecord ? didRecord.data.replace("did=", "") : null
3737+ // We return the DID if we found one and it's valid
3838+ return didRecord && isValidDID(didRecord.data.replace("did=", ""))
3939+ ? didRecord.data.replace("did=", "")
4040+ : null
3141}
32423343// Function to check for a DID in the well-known (not .well-known) location
···3747 `https://${domain}/xrpc/com.atproto.identity.resolveHandle`
3848 )
3949 const data = await response.json()
4040- return data.did
5050+ return data.did && isValidDID(data.did) ? data.did : null
4151 } catch (error) {
4252 return null
4353 }