[PR #805] [MERGED] fix(browser): preserve Link header value delimiters #2253

New issue

Closed

opened 2026-10-16 21:16:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/805
Author: @rudycelekli
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/link-header-delimiters-20261006

📝 Commits (1)

64bdae7 fix(browser): preserve Link header value delimiters

📊 Changes

2 files changed (+79 additions, -6 deletions)

View changed files

📝 src/browser/CdpSafeMetadata.ts (+20 -6)
📝 tests/boundary/browser/cdpSafeMetadata.test.ts (+59 -0)

📄 Description

Summary

Preserve Link header delimiters inside <URI-reference> targets and quoted parameter values. A comma in a valid target currently drops that link; a semicolon in a quoted media type truncates the reported type. Use one scanner for entry and parameter boundaries, including quoted-pair escape parity.

The metadata allowlist, origin classification and untrusted declarations remain unchanged. This is a delimiter correction, not a complete RFC 8288 parser or a change to discovery authorization.

Validation

Actual system Chrome, an owned profile and loopback HTTP server; public CdpBrowserProvider.inspectPage captures real response events. A progress handshake triggers the HTTP fetch after observation starts. Both ordinary comma-target and quoted media-type cases fail before, pass after; the ordinary header control passes.
10 focused metadata tests pass, including quoted escapes and outside-policy classification.
Exact signed head npm run check passes (129 existing warnings, zero errors), and npm run check:fast passes.

Native proof is macOS/system Chrome only; hosted CI is separate. An earlier unpublished local comma-only draft existed; this PR groups the entry and parameter delimiter class.

AI assistance was used for investigation, implementation and tests; I reviewed the change and native results.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/805 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/link-header-delimiters-20261006` --- ### 📝 Commits (1) - [`64bdae7`](https://github.com/morluto/rea/commit/64bdae71c3ea2da8e377c9a935de8978c7638a0f) fix(browser): preserve Link header value delimiters ### 📊 Changes **2 files changed** (+79 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/CdpSafeMetadata.ts` (+20 -6) 📝 `tests/boundary/browser/cdpSafeMetadata.test.ts` (+59 -0) </details> ### 📄 Description ## Summary Preserve Link header delimiters inside `<URI-reference>` targets and quoted parameter values. A comma in a valid target currently drops that link; a semicolon in a quoted media type truncates the reported type. Use one scanner for entry and parameter boundaries, including quoted-pair escape parity. The metadata allowlist, origin classification and untrusted declarations remain unchanged. This is a delimiter correction, not a complete RFC 8288 parser or a change to discovery authorization. ## Validation - Actual system Chrome, an owned profile and loopback HTTP server; public `CdpBrowserProvider.inspectPage` captures real response events. A progress handshake triggers the HTTP fetch after observation starts. Both ordinary comma-target and quoted media-type cases fail before, pass after; the ordinary header control passes. - 10 focused metadata tests pass, including quoted escapes and outside-policy classification. - Exact signed head `npm run check` passes (129 existing warnings, zero errors), and `npm run check:fast` passes. Native proof is macOS/system Chrome only; hosted CI is separate. An earlier unpublished local comma-only draft existed; this PR groups the entry and parameter delimiter class. AI assistance was used for investigation, implementation and tests; I reviewed the change and native results. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:18 +00:00