Codeman maintainer
d9364f52e1
fix(webview): refuse a backslash or tab-led recovery path, which the URL parser reads as an origin
...
The lost-frame handler in webview-tabs.js remounts a web-tab frame at the path
the frame reports it lost. It promised "path only, never an origin" and collapsed
a leading run of slashes so `//host/x` could not jump the frame off the proxy,
but it left two spellings through that the WHATWG URL parser treats the same way:
a backslash, which is read as `/` for http(s) schemes, and an ASCII tab or
newline, which the parser deletes before it looks at anything, so `/\host/x` and
`/<tab>/host/x` both resolve to `https://host/x `. That mattered only in
direct-mode tabs, where `POST /api/webviews/:id/open` returns no embedUrl and the
recovered path is resolved with `new URL(path, src)` straight into the frame's
src; a page in such a tab could remount its own frame on a foreign origin.
Not an escalation (the page can already navigate itself anywhere, and the remount
carries no Codeman-origin access), but the comment did not hold and the existing
test only covered the form that already worked. The handler now strips tab, CR
and LF, collapses any leading run of `/` or `\` to one `/`, and refuses whatever
still opens a second separator. The new test drives the reachable direct-mode
branch with all four spellings and fails without the fix.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-09-14 23:38:54 +02:00
..
2026-08-22 14:13:57 +02:00
2026-09-14 23:30:14 +02:00
2026-09-06 23:02:33 +02:00
2026-09-14 15:59:00 +02:00
2026-09-06 21:53:38 +02:00
2026-08-22 14:13:58 +02:00
2026-06-10 01:38:40 +02:00
2026-07-20 17:35:40 +02:00
2026-08-10 12:29:00 +02:00
2026-09-07 19:09:24 +02:00
2026-09-13 17:43:14 +08:00
2026-08-12 02:30:08 +02:00
2026-09-02 08:26:45 +08:00
2026-09-07 19:09:24 +02:00
2026-08-08 22:30:39 +03:00
2026-08-21 02:37:58 +02:00
2026-08-05 01:40:37 +02:00
2026-01-27 23:15:25 +01:00
2026-06-09 20:02:15 +02:00
2026-09-02 10:48:51 +02:00
2026-08-20 12:18:16 +02:00
2026-07-12 17:50:21 +02:00
2026-06-14 12:46:58 -04:00
2026-06-19 17:58:06 -04:00
2026-06-19 17:58:06 -04:00
2026-09-06 23:11:01 +02:00
2026-09-04 16:08:57 -04:00
2026-02-12 13:44:07 +01:00
2026-03-07 07:33:44 +01:00
2026-02-26 16:44:34 +01:00
2026-08-07 16:41:39 +02:00
2026-08-10 11:19:51 +02:00
2026-07-20 02:48:14 +02:00
2026-08-20 11:21:29 +02:00
2026-03-01 16:50:23 +01:00
2026-09-02 08:26:45 +08:00
2026-09-13 17:43:13 +08:00
2026-08-22 14:36:23 +02:00
2026-08-21 02:37:58 +02:00
2026-09-02 08:26:45 +08:00
2026-09-07 21:30:31 -05:00
2026-09-07 22:42:20 +02:00
2026-09-02 08:26:45 +08:00
2026-09-04 14:20:11 +02:00
2026-08-22 14:13:57 +02:00
2026-06-14 12:46:58 -04:00
2026-08-26 18:43:52 +08:00
2026-08-09 05:02:14 +02:00
2026-09-06 21:53:38 +02:00
2026-08-21 08:23:31 -04:00
2026-06-10 22:47:02 +02:00
2026-09-06 21:53:38 +02:00
2026-09-06 19:45:36 +02:00
2026-07-12 18:42:36 +02:00
2026-08-09 15:56:44 +02:00
2026-09-06 23:05:26 +02:00
2026-08-23 14:46:10 -04:00
2026-06-29 11:35:56 +05:30
2026-09-04 16:08:57 -04:00
2026-03-01 16:50:23 +01:00
2026-08-24 18:00:52 +02:00
2026-09-02 08:26:45 +08:00
2026-08-24 18:00:52 +02:00
2026-08-25 18:30:41 +02:00
2026-08-25 03:08:15 +02:00
2026-09-02 08:26:45 +08:00
2026-08-22 14:13:57 +02:00
2026-08-18 23:24:22 +02:00
2026-09-09 15:24:55 +02:00
2026-09-05 16:22:54 +02:00
2026-09-13 17:43:14 +08:00
2026-09-02 19:33:32 +08:00
2026-09-14 23:37:04 +02:00
2026-08-27 19:38:38 +08:00
2026-07-20 02:36:02 +02:00
2026-09-01 11:32:03 +02:00
2026-09-04 14:36:35 +02:00
2026-06-14 08:43:57 +02:00
2026-06-14 08:43:57 +02:00
2026-06-12 09:09:14 -04:00
2026-07-12 17:50:21 +02:00
2026-09-02 20:41:24 -05:00
2026-06-07 04:33:11 +02:00
2026-09-10 02:57:40 +02:00
2026-08-09 22:39:07 +02:00
2026-08-23 21:40:10 -04:00
2026-09-04 16:08:57 -04:00
2026-08-05 08:44:47 +02:00
2026-06-10 01:30:43 +02:00
2026-08-29 23:31:28 -07:00
2026-09-04 16:08:57 -04:00
2026-09-04 16:08:57 -04:00
2026-08-19 23:35:45 +02:00
2026-06-09 20:02:15 +02:00
2026-09-14 16:02:02 +02:00
2026-09-01 12:30:48 +08:00
2026-06-19 13:10:17 -04:00
2026-07-12 17:50:21 +02:00
2026-08-10 00:07:01 +02:00
2026-08-23 08:39:03 +02:00
2026-08-23 08:39:03 +02:00
2026-07-12 18:06:59 +02:00
2026-08-05 02:38:57 +02:00
2026-08-10 03:15:13 +02:00
2026-08-22 01:55:50 +08:00
2026-08-10 11:16:58 +02:00
2026-09-08 00:56:39 -04:00
2026-08-09 14:04:34 +02:00
2026-09-14 15:59:00 +02:00
2026-08-23 14:46:10 -04:00
2026-08-14 00:14:21 +02:00
2026-07-21 02:49:25 +08:00
2026-09-08 16:49:50 +02:00
2026-06-12 09:09:14 -04:00
2026-08-25 19:41:48 +02:00
2026-08-20 10:35:23 -04:00
2026-08-17 01:46:48 +02:00
2026-09-13 17:43:13 +08:00
2026-09-14 15:55:20 +02:00
2026-09-02 20:41:24 -05:00
2026-08-09 18:03:13 +02:00
2026-08-05 02:38:57 +02:00
2026-08-16 20:34:34 +02:00
2026-08-23 08:39:03 +02:00
2026-09-02 08:26:45 +08:00
2026-03-07 07:33:44 +01:00
2026-06-14 22:21:13 +02:00
2026-08-16 20:34:34 +02:00
2026-02-26 16:44:34 +01:00
2026-09-08 00:56:39 -04:00
2026-08-19 19:14:52 +00:00
2026-09-08 00:56:39 -04:00
2026-09-14 23:30:14 +02:00
2026-09-08 00:56:39 -04:00
2026-07-20 12:33:12 +02:00
2026-02-18 12:51:35 +01:00
2026-08-09 13:23:24 +02:00
2026-06-08 11:01:34 -04:00
2026-07-19 15:32:45 +02:00
2026-02-12 13:44:07 +01:00
2026-08-04 15:02:46 +02:00
2026-07-28 23:20:01 +03:00
2026-08-28 11:32:30 -05:00
2026-09-12 05:15:41 +02:00
2026-08-28 13:45:12 -05:00
2026-09-07 22:11:54 -05:00
2026-08-24 19:06:50 +08:00
2026-09-02 20:41:24 -05:00
2026-03-21 19:23:37 +01:00
2026-03-21 07:20:18 +01:00
2026-07-20 04:02:46 +02:00
2026-08-09 16:16:54 +02:00
2026-09-10 12:42:33 +08:00
2026-08-09 17:32:24 +02:00
2026-06-08 10:27:18 -04:00
2026-02-26 16:44:34 +01:00
2026-08-21 02:37:58 +02:00
2026-08-13 17:23:27 +02:00
2026-09-01 11:32:18 +02:00
2026-09-14 15:59:00 +02:00
2026-08-26 18:43:52 +08:00
2026-09-14 14:28:57 +02:00
2026-08-07 01:34:47 +02:00
2026-02-12 18:26:16 +01:00
2026-06-09 20:02:17 +02:00
2026-08-09 16:03:27 +02:00
2026-07-28 04:15:30 +02:00
2026-08-09 03:30:15 +02:00
2026-01-21 22:36:45 +01:00
2026-09-02 20:41:24 -05:00
2026-02-19 14:00:10 +01:00
2026-08-20 12:58:17 -04:00
2026-06-10 18:06:45 +02:00
2026-03-01 16:50:23 +01:00
2026-08-09 23:05:11 +02:00
2026-08-09 23:05:11 +02:00
2026-09-08 00:56:39 -04:00
2026-08-09 23:05:11 +02:00
2026-06-19 16:58:40 +02:00
2026-09-04 13:50:22 +02:00
2026-07-17 16:03:03 -04:00
2026-08-05 01:40:37 +02:00
2026-07-17 15:54:32 -04:00
2026-09-07 21:30:31 -05:00
2026-08-07 05:05:41 +02:00
2026-09-04 16:08:57 -04:00
2026-08-21 02:25:43 +02:00
2026-03-07 07:33:44 +01:00
2026-02-26 16:44:34 +01:00
2026-06-10 20:41:34 +02:00
2026-03-07 07:33:44 +01:00
2026-03-07 07:33:44 +01:00
2026-08-09 15:31:02 +02:00
2026-07-12 18:21:42 +02:00
2026-01-25 07:52:40 +01:00
2026-08-18 10:59:44 -04:00
2026-03-01 14:33:18 +01:00
2026-02-26 16:44:34 +01:00
2026-08-19 19:14:52 +00:00
2026-08-16 20:34:34 +02:00
2026-09-12 05:15:41 +02:00
2026-08-21 02:25:43 +02:00
2026-09-01 12:30:48 +08:00
2026-09-06 21:53:38 +02:00
2026-07-17 16:26:28 -04:00
2026-08-18 10:46:21 -04:00
2026-08-26 20:05:48 -05:00
2026-08-23 14:46:10 -04:00
2026-06-10 03:41:04 +02:00
2026-02-18 18:14:13 +01:00
2026-08-10 03:15:13 +02:00
2026-06-09 20:02:15 +02:00
2026-06-10 17:08:36 +02:00
2026-08-16 20:34:34 +02:00
2026-08-05 01:53:43 +02:00
2026-08-09 01:34:55 +02:00
2026-09-07 22:42:20 +02:00
2026-07-12 19:49:58 +02:00
2026-06-10 20:41:34 +02:00
2026-09-07 08:48:31 +02:00
2026-09-02 20:41:24 -05:00
2026-08-09 01:18:03 +02:00
2026-08-17 22:54:46 +02:00
2026-08-10 03:15:13 +02:00
2026-08-23 12:21:02 -04:00
2026-08-24 22:58:28 +02:00
2026-07-12 17:50:21 +02:00
2026-06-10 04:07:26 +02:00
2026-08-23 12:21:02 -04:00
2026-08-23 12:21:02 -04:00
2026-08-23 14:46:10 -04:00
2026-07-17 16:21:16 -04:00
2026-08-16 05:11:00 +02:00
2026-07-17 16:25:29 -04:00
2026-06-17 23:41:47 +08:00
2026-08-17 21:42:25 +02:00
2026-08-23 12:21:02 -04:00
2026-08-24 00:59:48 +02:00
2026-02-26 16:44:34 +01:00
2026-08-03 21:22:33 +08:00
2026-09-01 02:31:26 +02:00
2026-08-09 01:18:03 +02:00
2026-08-09 21:32:04 -04:00
2026-06-10 01:30:43 +02:00
2026-09-06 23:11:01 +02:00
2026-08-05 01:40:37 +02:00
2026-08-10 03:59:43 +02:00
2026-09-14 23:33:36 +02:00
2026-08-07 01:31:50 +02:00
2026-09-02 20:41:24 -05:00
2026-08-13 17:28:35 +02:00
2026-06-09 20:02:15 +02:00
2026-08-13 17:28:35 +02:00
2026-09-02 20:41:24 -05:00
2026-03-07 07:33:44 +01:00
2026-08-23 14:46:10 -04:00
2026-08-23 14:46:10 -04:00
2026-08-18 23:24:22 +02:00
2026-09-14 15:59:00 +02:00
2026-01-22 11:30:10 +01:00
2026-05-12 10:11:47 +02:00
2026-06-15 01:43:15 +02:00
2026-08-23 14:46:10 -04:00
2026-08-23 14:46:10 -04:00
2026-08-23 14:46:10 -04:00
2026-08-24 00:59:48 +02:00
2026-08-23 14:46:10 -04:00
2026-08-23 14:46:10 -04:00
2026-08-23 12:21:02 -04:00
2026-08-10 03:06:23 +02:00
2026-09-12 06:09:28 +02:00
2026-08-23 12:21:02 -04:00
2026-08-25 18:26:07 +02:00
2026-02-28 17:39:44 +01:00
2026-02-28 17:39:44 +01:00
2026-01-21 07:19:49 +01:00
2026-02-26 16:44:34 +01:00
2026-06-10 18:06:45 +02:00
2026-08-20 10:46:11 +02:00
2026-07-10 14:39:19 -04:00
2026-08-05 02:38:57 +02:00
2026-09-07 19:11:20 -04:00
2026-08-24 19:06:50 +08:00
2026-09-09 16:57:42 +02:00
2026-09-14 14:09:13 +02:00
2026-09-14 14:09:13 +02:00
2026-06-30 19:52:49 -04:00
2026-07-12 12:39:46 +02:00
2026-09-07 19:11:20 -04:00
2026-09-12 06:09:43 +02:00
2026-06-09 15:39:03 -04:00
2026-08-19 19:41:43 +00:00
2026-02-26 16:44:34 +01:00
2026-08-24 19:06:50 +08:00
2026-08-14 00:00:59 +02:00
2026-08-20 11:21:29 +02:00
2026-09-06 23:11:01 +02:00
2026-08-18 19:55:23 +02:00
2026-06-09 15:39:03 -04:00
2026-09-09 15:35:02 +02:00
2026-09-14 15:59:00 +02:00
2026-07-12 19:49:58 +02:00
2026-07-10 11:14:26 -04:00
2026-05-25 23:28:58 +02:00
2026-08-09 18:03:13 +02:00
2026-07-20 03:26:21 +02:00
2026-06-10 20:41:34 +02:00
2026-09-14 15:59:00 +02:00
2026-07-20 02:58:51 +02:00
2026-01-22 11:30:10 +01:00
2026-09-14 15:57:08 +02:00
2026-08-10 11:19:51 +02:00
2026-07-12 12:42:36 +02:00
2026-09-10 14:13:15 +08:00
2026-09-04 15:21:13 +02:00
2026-09-04 15:21:12 +02:00
2026-09-04 15:21:12 +02:00
2026-09-14 23:38:54 +02:00
2026-07-29 09:01:18 +02:00
2026-08-09 04:06:23 +02:00
2026-09-10 14:13:15 +08:00
2026-08-23 14:12:38 -04:00
2026-07-21 00:04:40 +08:00
2026-07-12 18:42:36 +02:00
2026-07-12 18:42:36 +02:00
2026-07-12 18:42:36 +02:00