[PR #780] [CLOSED] fix(browser): resolve DOM destinations against document base URL #2237

New issue

Closed

opened 2026-10-16 21:16:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/780
Author: @rudycelekli
Created: 10/6/2026
Status: ❌ Closed

Base: main ← Head: fix/rea-dom-base-url-20261006

📝 Commits (1)

77d1afb fix(browser): resolve DOM destinations against document base URL

📊 Changes

4 files changed (+136 additions, -16 deletions)

View changed files

📝 scripts/fixtures/browser-verifier-site.mjs (+1 -1)
📝 scripts/lib/browser-verifier-assertions.mjs (+11 -2)
➕ src/browser/CdpCaptureDocuments.baseUrl.test.ts (+115 -0)
📝 src/browser/CdpCaptureDocuments.ts (+9 -13)

📄 Description

Summary

Resolve live DOM destinations against Chrome's document base URL. Self-contained browser capture bug; no separate issue linked.

Problem and expected behavior

A page with <base href="assets/"> exposes its resolved document.baseURI in DOMSnapshot. Capture ignored it and resolved relative link/form/agent declarations against the document URL, producing wrong metadata. A base pointing outside the allowed origins also caused relative declarations to appear approved under the document origin. Metadata should match native browser resolution and then apply the existing destination policy.

Change and scope

Use DOMSnapshot's indexed baseURL, falling back to the document URL when absent. Resolve the BASE element's own href against the fallback document URL to avoid applying its relative base twice. Document admission still uses the document URL; destination admission still uses the resolved URL's allowed origin. Passive metadata only: no navigation or authority changes.

Related merged #589 corrected static local artifact HTML script path relationships in JavaScriptArtifactPathResolution. This changes the separate live CDP DOMSnapshot producer and its DOM URL/form-action/agent-hint metadata; it does not change local artifact path resolution or confinement. The prior PR's complete diff and owner follow-up were reviewed for overlap.

Contract and boundary impact

Semantic owner and earliest changed stage: CDP DOMSnapshot destination metadata projection.
CLI and MCP/tool-catalog contract: unchanged tools/schemas; corrected existing metadata URLs and destination classifications.
Provider, bridge, target-format, or platform compatibility: live Chrome CDP DOMSnapshot baseURL; missing baseURL retains fallback.
Evidence, artifact, provenance, or reconstruction contract: native resolved destinations agree with the browser; page-declared agent hints remain untrusted.
Process execution, authorization, cleanup, or containment impact: document and destination origin admission unchanged; no additional page code execution or following links.
Generated metadata (docs/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: relative base, absent base, foreign base destination filtering, approved absolute destination, and foreign document admission controls. Actual browser verifier now asserts a relative link under a BASE element.
Base reproduction or other evidence: actual Chrome154 owned loopback page, native document.baseURI/href/action oracle and public CdpBrowserProvider inspectPage: three mismatches before, four scenarios matching after (relative, absolute, absent and foreign base). Focused baseline has two failures and three passing controls.
User-visible CLI/MCP output: e.g. relative guide under assets/ now reports <origin>/assets/guide; foreign-base destinations report null and outside_policy.
Remaining proof gaps: actual Chrome154 on macOS arm64 only. Full hosted platform matrix tracked separately. Native verifier process-lineage metadata reports unavailable due to descendant run token mismatch; the browser verification itself succeeds.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Actual owned Chrome native before/after capture — three mismatches before; all four scenarios match after, including outside-policy filtering.
npm run test:focused -- src/browser/CdpCaptureDocuments.baseUrl.test.ts src/browser/CdpCaptureDocuments.test.ts tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts — 14 passed across 3 files.
npm run check — 5 tasks successful; 125 existing warnings, zero errors.
npm run check:fast — 2 tasks successful.
npm run verify:browser — actual Chrome154/PWcore1.58.2, verified true; CLI/MCP capture, source maps, 9.4MiB native PNG, popup and scenario cleanup controls pass. Process-lineage limitation stated above.
Oxfmt and git diff --check — passed; SSH signature and DCO verified. Reused exact Node24.18.0/Vitest5.0.3/TypeScript7.0.2 without dependency edits.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: actual Chrome154 on macOS arm64; binary providers not affected.
Package or release metadata impact: none.
Security, privacy, process, or containment review: resolution context only; selected document admission and final destination origin checks remain authoritative. Passive capture does not follow destinations or grant base origins access. Owned ephemeral profiles and loopback fixtures are cleaned up.

AI assistance: implemented and independently source reviewed with Codex on behalf of @rudycelekli before publication.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/780 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/rea-dom-base-url-20261006` --- ### 📝 Commits (1) - [`77d1afb`](https://github.com/morluto/rea/commit/77d1afb43ad908a405f7fc966372ca2839e50629) fix(browser): resolve DOM destinations against document base URL ### 📊 Changes **4 files changed** (+136 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `scripts/fixtures/browser-verifier-site.mjs` (+1 -1) 📝 `scripts/lib/browser-verifier-assertions.mjs` (+11 -2) ➕ `src/browser/CdpCaptureDocuments.baseUrl.test.ts` (+115 -0) 📝 `src/browser/CdpCaptureDocuments.ts` (+9 -13) </details> ### 📄 Description ## Summary Resolve live DOM destinations against Chrome's document base URL. Self-contained browser capture bug; no separate issue linked. ## Problem and expected behavior A page with `<base href="assets/">` exposes its resolved `document.baseURI` in DOMSnapshot. Capture ignored it and resolved relative link/form/agent declarations against the document URL, producing wrong metadata. A base pointing outside the allowed origins also caused relative declarations to appear approved under the document origin. Metadata should match native browser resolution and then apply the existing destination policy. ## Change and scope Use DOMSnapshot's indexed `baseURL`, falling back to the document URL when absent. Resolve the BASE element's own href against the fallback document URL to avoid applying its relative base twice. Document admission still uses the document URL; destination admission still uses the resolved URL's allowed origin. Passive metadata only: no navigation or authority changes. Related merged #589 corrected static local artifact HTML script path relationships in `JavaScriptArtifactPathResolution`. This changes the separate live CDP DOMSnapshot producer and its DOM URL/form-action/agent-hint metadata; it does not change local artifact path resolution or confinement. The prior PR's complete diff and owner follow-up were reviewed for overlap. ## Contract and boundary impact - Semantic owner and earliest changed stage: CDP DOMSnapshot destination metadata projection. - CLI and MCP/tool-catalog contract: unchanged tools/schemas; corrected existing metadata URLs and destination classifications. - Provider, bridge, target-format, or platform compatibility: live Chrome CDP DOMSnapshot baseURL; missing baseURL retains fallback. - Evidence, artifact, provenance, or reconstruction contract: native resolved destinations agree with the browser; page-declared agent hints remain untrusted. - Process execution, authorization, cleanup, or containment impact: document and destination origin admission unchanged; no additional page code execution or following links. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: relative base, absent base, foreign base destination filtering, approved absolute destination, and foreign document admission controls. Actual browser verifier now asserts a relative link under a BASE element. - Base reproduction or other evidence: actual Chrome154 owned loopback page, native document.baseURI/href/action oracle and public CdpBrowserProvider inspectPage: three mismatches before, four scenarios matching after (relative, absolute, absent and foreign base). Focused baseline has two failures and three passing controls. - User-visible CLI/MCP output: e.g. relative `guide` under `assets/` now reports `<origin>/assets/guide`; foreign-base destinations report null and `outside_policy`. - Remaining proof gaps: actual Chrome154 on macOS arm64 only. Full hosted platform matrix tracked separately. Native verifier process-lineage metadata reports unavailable due to descendant run token mismatch; the browser verification itself succeeds. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Actual owned Chrome native before/after capture — three mismatches before; all four scenarios match after, including outside-policy filtering. - `npm run test:focused -- src/browser/CdpCaptureDocuments.baseUrl.test.ts src/browser/CdpCaptureDocuments.test.ts tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts` — 14 passed across 3 files. - `npm run check` — 5 tasks successful; 125 existing warnings, zero errors. - `npm run check:fast` — 2 tasks successful. - `npm run verify:browser` — actual Chrome154/PWcore1.58.2, verified true; CLI/MCP capture, source maps, 9.4MiB native PNG, popup and scenario cleanup controls pass. Process-lineage limitation stated above. - Oxfmt and `git diff --check` — passed; SSH signature and DCO verified. Reused exact Node24.18.0/Vitest5.0.3/TypeScript7.0.2 without dependency edits. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: actual Chrome154 on macOS arm64; binary providers not affected. - Package or release metadata impact: none. - Security, privacy, process, or containment review: resolution context only; selected document admission and final destination origin checks remain authoritative. Passive capture does not follow destinations or grant base origins access. Owned ephemeral profiles and loopback fixtures are cleaned up. AI assistance: implemented and independently source reviewed with Codex on behalf of @rudycelekli before publication. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:04 +00:00