[PR #814] [CLOSED] fix(browser): normalize Referrer-Policy fallback lists #2261

New issue

Closed

opened 2026-10-16 21:16:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/814
Author: @rudycelekli
Created: 10/7/2026
Status: ❌ Closed

Base: main ← Head: fix/referrer-policy-fallback-lists-20261006

📝 Commits (1)

a457102 fix(browser): normalize referrer policy fallback lists

📊 Changes

3 files changed (+66 additions, -1 deletions)

View changed files

📝 docs/browser-observation.md (+2 -0)
📝 src/browser/CdpSafeMetadata.ts (+22 -1)
📝 tests/boundary/browser/cdpSafeMetadata.test.ts (+42 -0)

📄 Description

Summary

Preserve declared Referrer-Policy fallback lists in browser response metadata. This focused parser fix does not require a large-contract issue. AI assistance was used; I reviewed the changes and executed the checks.

Problem and expected behavior

no-referrer, strict-origin-when-cross-origin currently yields referrer_policy: null, although Chrome uses the last recognized policy. Unknown-only names instead appear recognized. The current W3 algorithm selects the last recognized nonempty policy.

Change and scope

Dedicated eight-policy normalization selects the last recognized token, skips empty/unknown names, normalizes mixed case and reports malformed syntax as null. Other policy-header parsers remain unchanged. This describes a response declaration, not effective document policy or browser defaults.

Contract and boundary impact

Semantic owner and earliest changed stage: CdpSafeMetadata response-header normalization.
CLI and MCP/tool-catalog contract: existing field, no schema/catalog change.
Provider, bridge, target-format, or platform compatibility: CDP; actual Chrome154.0.8037.94 tested.
Evidence, artifact, provenance, or reconstruction contract: recognized declaration retained; unknown remains null.
Process execution, authorization, cleanup, or containment impact: none.
Generated metadata (docs/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated:18 table cases, all eight policies, list order, unknown/missing/empty values, mixed case, empty entries, malformed input; other policy controls retained.
Base reproduction or other evidence:main472b72a gives6fail/17pass. Actual public inspectPage against owned dual-loopback HTTP servers loses three valid lists, independently verified using actual Chrome response headers and outgoing Referer.
User-visible CLI/MCP output:example now reports referrer_policy: "strict-origin-when-cross-origin".
Remaining proof gaps:no effective-policy/default inference, cross-browser matrix or request-override claim.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

node node_modules/vitest/vitest.mjs run tests/boundary/browser/cdpSafeMetadata.test.ts tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts:28passed.
npm run check:five tasks passed;129existingwarnings/zero lint errors.
npm run check:fast:two tasks passed.
npm run docs:check, npm run build, npm run verify:browser:passed.
External actual Chrome/public CdpBrowserProvider fixture:eight cases passed, including three valid fallback lists, ordinary single policy, mixed case, empty entries, quoted malformed input and unknown-only input. Actual cross-origin requests independently confirm the observed behavior; no synthetic events.

Two initial test-table type-inference failures retained; explicit tuple typing fixed them without changing production behavior or assertions.

Compatibility, safety, and release

Breaking changes or migration steps:no schema/migration; unknown-only declarations now null instead of unknown string.
Real Hopper/Ghidra, browser, or OS coverage:actual local Chrome on macOS; no Hopper/Ghidra or browser/OS matrix claim.
Package or release metadata impact:none.
Security, privacy, process, or containment review:normalization only; admission/authority unchanged, raw headers remain discarded.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/814 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/7/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/referrer-policy-fallback-lists-20261006` --- ### 📝 Commits (1) - [`a457102`](https://github.com/morluto/rea/commit/a4571028a8ece23f706e95dfa9b34df5fc9ab5ad) fix(browser): normalize referrer policy fallback lists ### 📊 Changes **3 files changed** (+66 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+2 -0) 📝 `src/browser/CdpSafeMetadata.ts` (+22 -1) 📝 `tests/boundary/browser/cdpSafeMetadata.test.ts` (+42 -0) </details> ### 📄 Description ## Summary Preserve declared Referrer-Policy fallback lists in browser response metadata. This focused parser fix does not require a large-contract issue. AI assistance was used; I reviewed the changes and executed the checks. ## Problem and expected behavior `no-referrer, strict-origin-when-cross-origin` currently yields `referrer_policy: null`, although Chrome uses the last recognized policy. Unknown-only names instead appear recognized. The current [W3 algorithm](https://w3c.github.io/webappsec-referrer-policy/#parse-referrer-policy-from-header) selects the last recognized nonempty policy. ## Change and scope Dedicated eight-policy normalization selects the last recognized token, skips empty/unknown names, normalizes mixed case and reports malformed syntax as null. Other policy-header parsers remain unchanged. This describes a response declaration, not effective document policy or browser defaults. ## Contract and boundary impact - Semantic owner and earliest changed stage: CdpSafeMetadata response-header normalization. - CLI and MCP/tool-catalog contract: existing field, no schema/catalog change. - Provider, bridge, target-format, or platform compatibility: CDP; actual Chrome154.0.8037.94 tested. - Evidence, artifact, provenance, or reconstruction contract: recognized declaration retained; unknown remains null. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated:18 table cases, all eight policies, list order, unknown/missing/empty values, mixed case, empty entries, malformed input; other policy controls retained. - Base reproduction or other evidence:main472b72a gives6fail/17pass. Actual public inspectPage against owned dual-loopback HTTP servers loses three valid lists, independently verified using actual Chrome response headers and outgoing Referer. - User-visible CLI/MCP output:example now reports `referrer_policy: "strict-origin-when-cross-origin"`. - Remaining proof gaps:no effective-policy/default inference, cross-browser matrix or request-override claim. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node node_modules/vitest/vitest.mjs run tests/boundary/browser/cdpSafeMetadata.test.ts tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts`:28passed. - `npm run check`:five tasks passed;129existingwarnings/zero lint errors. - `npm run check:fast`:two tasks passed. - `npm run docs:check`, `npm run build`, `npm run verify:browser`:passed. - External actual Chrome/public CdpBrowserProvider fixture:eight cases passed, including three valid fallback lists, ordinary single policy, mixed case, empty entries, quoted malformed input and unknown-only input. Actual cross-origin requests independently confirm the observed behavior; no synthetic events. Two initial test-table type-inference failures retained; explicit tuple typing fixed them without changing production behavior or assertions. ## Compatibility, safety, and release - Breaking changes or migration steps:no schema/migration; unknown-only declarations now null instead of unknown string. - Real Hopper/Ghidra, browser, or OS coverage:actual local Chrome on macOS; no Hopper/Ghidra or browser/OS matrix claim. - Package or release metadata impact:none. - Security, privacy, process, or containment review:normalization only; admission/authority unchanged, raw headers remain discarded. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:26 +00:00