[GH-ISSUE #6506] [Bug] Browser Link metadata drops anchor context and attributes another document's relation to the inspected page #3901

New issue

Closed

opened 2026-10-31 00:45:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:04 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6506

Before submitting

I searched open issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The projection emits an ordinary link to https://example.test/agent and the same page-declared-untrusted agent hint as the unanchored control, with no retained anchor or contextual limitation. The relation actually belongs to /other-document.

Observed at the production metadata-projection boundary with a synthetic CDP response. This is not a browser end-to-end reproduction.

Reproduction

From the built checkout, run this with the repository-pinned Node.js:

node --input-type=module <<'JS'
import { safeResponseMetadata } from './dist/browser/CdpSafeMetadata.js';
const origin = 'https://example.test';
const link = '</agent>; rel="mcp"; anchor="/other-document"';
const result = safeResponseMetadata(
  'request', origin + '/page',
  { mimeType: 'text/html', headers: { Link: link } },
  new Set([origin]),
);
console.log(JSON.stringify({
  rel: result.response.links[0]?.rel,
  agentHints: result.agentHints,
}));
JS

The executed probe passed these exact arguments to the helper. This case and the ordinary </agent>; rel="mcp" control each ran once. The control projected rel: ["mcp"] and one link_rel hint. No post-draft replay is claimed.

Expected behavior

RFC 8288 section 3.2 makes anchor override the link context. A parser may retain that context or ignore the anchored link entirely when it cannot apply the context; it must not process it as an unanchored relation of the response document.

Contract: RFC 8288. REA documents structured Link metadata and derived untrusted agent hints in docs/browser-observation.md.

Impact and scope

An analyst receives incorrect relationship attribution and an agent-discovery hint that belongs to a different document. This report concerns metadata correctness only; no trust or authorization bypass was tested or claimed. Frequency on real targets is NOT_ENOUGH_INFO; only the supplied fixture was exercised. No automatic general workaround was tested.

REA version

Source revision 4c547008c53ee9f0ff2368e7d874a2c3347aa235, package version 6.7.0. Built current main; the published package was not separately replayed.

Runtime and platform

Node.js v24.18.0; Linux x86_64. No browser or CDP connection was started.

Target and artifact context

Synthetic ordinary HTTP Link metadata for https://example.test/page, with all fixture URLs on the selected origin. Header: </agent>; rel="mcp"; anchor="/other-document".

Interface

Other

Production browser metadata helper; CLI/MCP reachability is source-derived.

Earliest failure stage

Capture or observation

Relevant output or evidence

Observed result projection:

{"rel":["mcp"],"agentHints":[{"mechanism":"link_rel","declaration":"mcp","url":"https://example.test/agent","trust":"page-declared-untrusted"}]}

The public inspect-web-page capture path calls this helper from CdpCaptureEventHandlers.ts:409, then appends its response metadata and agent hints unchanged. The relevant parser is CdpSafeMetadata.ts.

Evidence provenance: observed helper result, with source-derived public reachability. Local verification: reproduced at the producer boundary. Browser acquisition and a full CLI/MCP capture remain untested.

Typed outcome or recovery expected

Retain the resolved context and avoid attributing this relation to /page, or omit this unsupported anchored link and its derived hint. The unanchored control should keep its existing hint.

Analysis or suspected cause

linkParameters reads anchor, but parseLinks never uses it, and the projected link/hint types have no context field. A correctly parsed rel value therefore still becomes incorrectly attributed evidence.

Additional context

Targeted open-issue searches for CdpSafeMetadata, Link anchor, Link rel, Link duplicate, and quoted-pair found no matching report. Closed issues were not searched. No source changes were made.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The production projection emits incorrect structured metadata for the concrete Link header above, with a discriminating ordinary-header control.
Workaround status: unverified
Workaround basis: The source header can be interpreted manually outside this projection, but no general automated recovery workflow for captured targets was tested.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6506 ## Before submitting - [x] I searched open issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The projection emits an ordinary link to `https://example.test/agent` and the same page-declared-untrusted agent hint as the unanchored control, with no retained anchor or contextual limitation. The relation actually belongs to `/other-document`. Observed at the production metadata-projection boundary with a synthetic CDP response. This is not a browser end-to-end reproduction. ## Reproduction From the built checkout, run this with the repository-pinned Node.js: ```sh node --input-type=module <<'JS' import { safeResponseMetadata } from './dist/browser/CdpSafeMetadata.js'; const origin = 'https://example.test'; const link = '</agent>; rel="mcp"; anchor="/other-document"'; const result = safeResponseMetadata( 'request', origin + '/page', { mimeType: 'text/html', headers: { Link: link } }, new Set([origin]), ); console.log(JSON.stringify({ rel: result.response.links[0]?.rel, agentHints: result.agentHints, })); JS ``` The executed probe passed these exact arguments to the helper. This case and the ordinary `</agent>; rel="mcp"` control each ran once. The control projected `rel: ["mcp"]` and one `link_rel` hint. No post-draft replay is claimed. ## Expected behavior RFC 8288 section 3.2 makes anchor override the link context. A parser may retain that context or ignore the anchored link entirely when it cannot apply the context; it must not process it as an unanchored relation of the response document. Contract: [RFC 8288](https://www.rfc-editor.org/rfc/rfc8288.html#section-3.2). REA documents structured Link metadata and derived untrusted agent hints in [docs/browser-observation.md](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/docs/browser-observation.md#L328). ## Impact and scope An analyst receives incorrect relationship attribution and an agent-discovery hint that belongs to a different document. This report concerns metadata correctness only; no trust or authorization bypass was tested or claimed. Frequency on real targets is NOT_ENOUGH_INFO; only the supplied fixture was exercised. No automatic general workaround was tested. ## REA version Source revision `4c547008c53ee9f0ff2368e7d874a2c3347aa235`, package version `6.7.0`. Built current main; the published package was not separately replayed. ## Runtime and platform Node.js `v24.18.0`; Linux x86_64. No browser or CDP connection was started. ## Target and artifact context Synthetic ordinary HTTP Link metadata for `https://example.test/page`, with all fixture URLs on the selected origin. Header: `</agent>; rel="mcp"; anchor="/other-document"`. ## Interface Other Production browser metadata helper; CLI/MCP reachability is source-derived. ## Earliest failure stage Capture or observation ## Relevant output or evidence Observed result projection: ```json {"rel":["mcp"],"agentHints":[{"mechanism":"link_rel","declaration":"mcp","url":"https://example.test/agent","trust":"page-declared-untrusted"}]} ``` The public `inspect-web-page` capture path calls this helper from [CdpCaptureEventHandlers.ts:409](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/src/browser/CdpCaptureEventHandlers.ts#L409), then appends its response metadata and agent hints unchanged. The relevant parser is [CdpSafeMetadata.ts](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/src/browser/CdpSafeMetadata.ts#L188-L210). Evidence provenance: observed helper result, with source-derived public reachability. Local verification: reproduced at the producer boundary. Browser acquisition and a full CLI/MCP capture remain untested. ## Typed outcome or recovery expected Retain the resolved context and avoid attributing this relation to `/page`, or omit this unsupported anchored link and its derived hint. The unanchored control should keep its existing hint. ## Analysis or suspected cause `linkParameters` reads anchor, but `parseLinks` never uses it, and the projected link/hint types have no context field. A correctly parsed rel value therefore still becomes incorrectly attributed evidence. ## Additional context Targeted open-issue searches for `CdpSafeMetadata`, `Link anchor`, `Link rel`, `Link duplicate`, and `quoted-pair` found no matching report. Closed issues were not searched. No source changes were made. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The production projection emits incorrect structured metadata for the concrete Link header above, with a discriminating ordinary-header control. - Workaround status: unverified - Workaround basis: The source header can be interpreted manually outside this projection, but no general automated recovery workflow for captured targets was tested.

bsakaguchi closed this issue

2026-10-31 00:45:05 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:44 +00:00

[PR #3901] [MERGED] fix(browser): keep malformed Electron CDP inventories incomplete #5959