Peter SteinbergerandYida-Dev 79659b2b14 fix(browser): land PR #11880 decodeURIComponent guardrails ...

Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog.
Landed from contributor @Yida-Dev (PR #11880).

Co-authored-by: Yida-Dev <[email protected]>

2026-02-26 14:37:48 +00:00

..

routes

fix(browser): land PR #11880 decodeURIComponent guardrails

2026-02-26 14:37:48 +00:00

bridge-auth-registry.ts

…

bridge-server.auth.test.ts

test: dedupe repeated test fixtures and assertions

2026-02-22 18:37:25 +00:00

bridge-server.ts

fix(sandbox): use one-time noVNC observer tokens

2026-02-21 13:56:58 +01:00

browser-utils.test.ts

fix: harden extension relay auth token flow

2026-02-21 19:24:42 +01:00

cdp.helpers.ts

refactor(browser): share checked fetch helper for cdp

2026-02-18 18:33:40 +00:00

cdp.test.ts

refactor(browser): centralize navigation guard enforcement

2026-02-21 11:46:11 +01:00

cdp.ts

refactor(browser): centralize navigation guard enforcement

2026-02-21 11:46:11 +01:00

chrome-extension-background-utils.test.ts

fix(browser): derive relay auth token from gateway token in Chrome extension

2026-02-23 18:56:14 +00:00

chrome-extension-manifest.test.ts

fix(browser): harden extension relay worker recovery

2026-02-22 19:08:38 +01:00

chrome-extension-options-validation.test.ts

refactor(browser): share relay token + options validation tests

2026-02-24 04:23:22 +00:00

chrome-user-data-dir.test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

chrome.default-browser.test.ts

test: dedupe repeated test fixtures and assertions

2026-02-22 18:37:25 +00:00

chrome.executables.ts

…

chrome.profile-decoration.ts

…

chrome.test.ts

test: dedupe repeated test fixtures and assertions

2026-02-22 18:37:25 +00:00

chrome.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

client-actions-core.ts

refactor(browser): share download request helper

2026-02-18 18:54:27 +00:00

client-actions-observe.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

client-actions-state.ts

…

client-actions-types.ts

…

client-actions-url.ts

…

client-actions.ts

…

client-fetch.loopback-auth.test.ts

refactor(security): unify local-host and tailnet CIDR checks

2026-02-22 17:20:27 +01:00

client-fetch.ts

refactor(security): unify local-host and tailnet CIDR checks

2026-02-22 17:20:27 +01:00

client.test.ts

…

client.ts

…

config.test.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

config.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

constants.ts

…

control-auth.auto-token.test.ts

test: dedupe gateway browser discord and channel coverage

2026-02-22 17:11:54 +00:00

control-auth.test.ts

test(browser): dedupe auth mode no-token assertions

2026-02-19 08:25:12 +00:00

control-auth.ts

Security: default gateway auth bootstrap and explicit mode none (#20686)

2026-02-19 02:35:50 -05:00

control-service.ts

refactor(browser): share control lifecycle helpers

2026-02-18 17:48:02 +00:00

csrf.ts

…

extension-relay-auth.test.ts

Browser relay: accept raw gateway token in extension auth

2026-02-23 18:56:14 +00:00

extension-relay-auth.ts

Browser relay: accept raw gateway token in extension auth

2026-02-23 18:56:14 +00:00

extension-relay.test.ts

fix(browser): land PR #11880 decodeURIComponent guardrails

2026-02-26 14:37:48 +00:00

extension-relay.ts

fix(browser): land PR #11880 decodeURIComponent guardrails

2026-02-26 14:37:48 +00:00

http-auth.ts

…

navigation-guard.test.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

navigation-guard.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

paths.test.ts

fix(security): harden browser trace/download temp path handling

2026-02-26 01:04:05 +01:00

paths.ts

refactor(browser): split act route modules and dedupe path guards

2026-02-26 01:21:34 +01:00

profiles-service.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

profiles-service.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

profiles.test.ts

test: optimize gateway infra memory and security coverage

2026-02-21 21:44:50 +00:00

profiles.ts

…

proxy-files.ts

…

pw-ai-module.ts

…

pw-ai-state.ts

…

pw-ai.test.ts

…

pw-ai.ts

…

pw-role-snapshot.test.ts

…

pw-role-snapshot.ts

refactor: extract shared dedupe helpers for runtime paths

2026-02-23 05:43:43 +00:00

pw-session.browserless.live.test.ts

perf(test): use expect.poll in browserless live test

2026-02-18 22:06:44 +00:00

pw-session.create-page.navigation-guard.test.ts

test(core): reduce mock reset overhead in targeted suites

2026-02-22 08:40:29 +00:00

pw-session.get-page-for-targetid.extension-fallback.test.ts

test(core): use lightweight clears in subagent and browser setup

2026-02-22 08:07:41 +00:00

pw-session.mock-setup.ts

fix(ci): add explicit mock types in pw-session mock setup

2026-02-22 08:05:12 +00:00

pw-session.test.ts

…

pw-session.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

pw-tools-core.activity.ts

…

pw-tools-core.clamps-timeoutms-scrollintoview.test.ts

test(browser): table-drive scroll and click error rewrites

2026-02-21 23:58:33 +00:00

pw-tools-core.downloads.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.interactions.evaluate.abort.test.ts

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

pw-tools-core.interactions.set-input-files.test.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.interactions.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.last-file-chooser-arm-wins.test.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.responses.ts

…

pw-tools-core.screenshots-element-selector.test.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.shared.ts

…

pw-tools-core.snapshot.navigate-guard.test.ts

refactor(browser): centralize navigation guard enforcement

2026-02-21 11:46:11 +01:00

pw-tools-core.snapshot.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

pw-tools-core.state.ts

…

pw-tools-core.storage.ts

…

pw-tools-core.test-harness.ts

…

pw-tools-core.trace.ts

…

pw-tools-core.ts

…

pw-tools-core.waits-next-download-saves-it.test.ts

test(browser): dedupe CDP and download setup helpers

2026-02-19 07:24:02 +00:00

resolved-config-refresh.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

screenshot.test.ts

test: move browser and web auto-reply local suites out of e2e

2026-02-22 11:05:26 +00:00

screenshot.ts

refactor(media): share image resize side grid and quality steps

2026-02-18 18:25:25 +00:00

server-context.chrome-test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server-context.ensure-tab-available.prefers-last-target.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-context.hot-reload-profiles.test.ts

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

server-context.remote-tab-ops.test.ts

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

server-context.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

server-context.types.ts

refactor(core): dedupe browser route signatures and cli watchdog schema

2026-02-18 14:15:20 +00:00

server-lifecycle.test.ts

test(browser): use lightweight clears in server lifecycle setup

2026-02-22 08:01:15 +00:00

server-lifecycle.ts

refactor(browser): share control lifecycle helpers

2026-02-18 17:48:02 +00:00

server-middleware.ts

…

server.agent-contract-form-layout-act-commands.test.ts

fix(security): harden browser trace/download temp path handling

2026-02-26 01:04:05 +01:00

server.agent-contract-snapshot-endpoints.test.ts

test: fix gate regressions

2026-02-24 04:39:53 +00:00

server.agent-contract.test-harness.ts

…

server.auth-token-gates-http.test.ts

…

server.control-server.test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server.evaluate-disabled-does-not-block-storage.test.ts

…

server.post-tabs-open-profile-unknown-returns-404.test.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server.ts

refactor(browser): share control lifecycle helpers

2026-02-18 17:48:02 +00:00

target-id.ts

…

test-port.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

trash.ts

refactor(security): unify secure id paths and guard weak patterns

2026-02-22 10:16:19 +01:00