github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-11 03:34:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(browser): land PR #11880 decodeURIComponent guardrails

Browse Source 
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog.
Landed from contributor @Yida-Dev (PR #11880).

Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
This commit is contained in:
Peter Steinberger
2026-02-26 14:37:33 +00:00
parent 62a248eb99
commit 79659b2b14
5 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/browser/extension-relay.test.ts
View File

@@ -208,6 +208,18 @@ describe("chrome extension relay server", () => {
expect(err.message).toContain("401");
});
it("returns 400 for malformed percent-encoding in target action routes", async () => {
const port = await getFreePort();
cdpUrl = `http://127.0.0.1:${port}`;
await ensureChromeExtensionRelayServer({ cdpUrl });
const res = await fetch(`${cdpUrl}/json/activate/%E0%A4%A`, {
headers: relayAuthHeaders(cdpUrl),
});
expect(res.status).toBe(400);
expect(await res.text()).toContain("invalid targetId encoding");
});
it("deduplicates concurrent relay starts for the same requested port", async () => {
const port = await getFreePort();
cdpUrl = `http://127.0.0.1:${port}`;