[GH-ISSUE #6505] [Bug] Browser Link metadata does not decode quoted-pair escapes in relation values #3902

New issue

Closed

opened 2026-10-31 00:45:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:04 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6505

Before submitting

I searched open issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The projected relation retains a literal backslash instead of decoding the quoted pair to mcp, and agentHints is empty.

Observed at the production metadata-projection boundary with a synthetic CDP response. This is not a browser end-to-end reproduction.

Reproduction

From the built checkout, run this with the repository-pinned Node.js:

node --input-type=module <<'JS'
import { safeResponseMetadata } from './dist/browser/CdpSafeMetadata.js';
const origin = 'https://example.test';
const link = String.raw`</agent>; rel="m\cp"`;
const result = safeResponseMetadata(
  'request', origin + '/page',
  { mimeType: 'text/html', headers: { Link: link } },
  new Set([origin]),
);
console.log(JSON.stringify({
  rel: result.response.links[0]?.rel,
  agentHints: result.agentHints,
}));
JS

The executed probe passed these exact arguments to the helper. This case and the ordinary </agent>; rel="mcp" control each ran once. The control projected rel: ["mcp"] and one link_rel hint. No post-draft replay is claimed.

Expected behavior

RFC 8288 Appendix B.4 removes the backslash of a quoted-pair and appends the following character. The quoted parameter here therefore has the value mcp, so its projection and derived hint should match the unescaped control.

Contract: RFC 8288. REA documents structured Link metadata and derived untrusted agent hints in docs/browser-observation.md.

Impact and scope

Valid quoted Link parameter values are misreported, and a semantically ordinary agent relation is omitted from derived hints. Other parameter spellings were not exercised. Frequency on real targets is NOT_ENOUGH_INFO; only the supplied fixture was exercised. No automatic general workaround was tested.

REA version

Source revision 4c547008c53ee9f0ff2368e7d874a2c3347aa235, package version 6.7.0. Built current main; the published package was not separately replayed.

Runtime and platform

Node.js v24.18.0; Linux x86_64. No browser or CDP connection was started.

Target and artifact context

Synthetic ordinary HTTP Link metadata for https://example.test/page, with all fixture URLs on the selected origin. Header: </agent>; rel="m\cp".

Interface

Other

Production browser metadata helper; CLI/MCP reachability is source-derived.

Earliest failure stage

Capture or observation

Relevant output or evidence

Observed result projection:

{"rel":["m\\cp"],"agentHints":[]}

The public inspect-web-page capture path calls this helper from CdpCaptureEventHandlers.ts:409, then appends its response metadata and agent hints unchanged. The relevant parser is CdpSafeMetadata.ts.

Evidence provenance: observed helper result, with source-derived public reachability. Local verification: reproduced at the producer boundary. Browser acquisition and a full CLI/MCP capture remain untested.

Typed outcome or recovery expected

The escaped and ordinary rel values should both project ["mcp"] and the same hint. Preserve delimiter recognition for quoted commas, semicolons and escaped quotation marks.

Analysis or suspected cause

The tokenizer recognizes backslash escapes while finding delimiters, but the unquote helper only strips surrounding quotation marks. It never decodes the quoted-pair. Fixing duplicate parameter precedence alone does not restore this case.

Additional context

Targeted open-issue searches for CdpSafeMetadata, Link anchor, Link rel, Link duplicate, and quoted-pair found no matching report. Closed issues were not searched. No source changes were made.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The production projection emits incorrect structured metadata for the concrete Link header above, with a discriminating ordinary-header control.
Workaround status: unverified
Workaround basis: The source header can be interpreted manually outside this projection, but no general automated recovery workflow for captured targets was tested.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6505 ## Before submitting - [x] I searched open issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The projected relation retains a literal backslash instead of decoding the quoted pair to `mcp`, and `agentHints` is empty. Observed at the production metadata-projection boundary with a synthetic CDP response. This is not a browser end-to-end reproduction. ## Reproduction From the built checkout, run this with the repository-pinned Node.js: ```sh node --input-type=module <<'JS' import { safeResponseMetadata } from './dist/browser/CdpSafeMetadata.js'; const origin = 'https://example.test'; const link = String.raw`</agent>; rel="m\cp"`; const result = safeResponseMetadata( 'request', origin + '/page', { mimeType: 'text/html', headers: { Link: link } }, new Set([origin]), ); console.log(JSON.stringify({ rel: result.response.links[0]?.rel, agentHints: result.agentHints, })); JS ``` The executed probe passed these exact arguments to the helper. This case and the ordinary `</agent>; rel="mcp"` control each ran once. The control projected `rel: ["mcp"]` and one `link_rel` hint. No post-draft replay is claimed. ## Expected behavior RFC 8288 Appendix B.4 removes the backslash of a quoted-pair and appends the following character. The quoted parameter here therefore has the value mcp, so its projection and derived hint should match the unescaped control. Contract: [RFC 8288](https://www.rfc-editor.org/rfc/rfc8288.html#appendix-B.4). REA documents structured Link metadata and derived untrusted agent hints in [docs/browser-observation.md](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/docs/browser-observation.md#L328). ## Impact and scope Valid quoted Link parameter values are misreported, and a semantically ordinary agent relation is omitted from derived hints. Other parameter spellings were not exercised. Frequency on real targets is NOT_ENOUGH_INFO; only the supplied fixture was exercised. No automatic general workaround was tested. ## REA version Source revision `4c547008c53ee9f0ff2368e7d874a2c3347aa235`, package version `6.7.0`. Built current main; the published package was not separately replayed. ## Runtime and platform Node.js `v24.18.0`; Linux x86_64. No browser or CDP connection was started. ## Target and artifact context Synthetic ordinary HTTP Link metadata for `https://example.test/page`, with all fixture URLs on the selected origin. Header: `</agent>; rel="m\cp"`. ## Interface Other Production browser metadata helper; CLI/MCP reachability is source-derived. ## Earliest failure stage Capture or observation ## Relevant output or evidence Observed result projection: ```json {"rel":["m\\cp"],"agentHints":[]} ``` The public `inspect-web-page` capture path calls this helper from [CdpCaptureEventHandlers.ts:409](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/src/browser/CdpCaptureEventHandlers.ts#L409), then appends its response metadata and agent hints unchanged. The relevant parser is [CdpSafeMetadata.ts](https://github.com/morluto/rea/blob/4c547008c53ee9f0ff2368e7d874a2c3347aa235/src/browser/CdpSafeMetadata.ts#L245-L256). Evidence provenance: observed helper result, with source-derived public reachability. Local verification: reproduced at the producer boundary. Browser acquisition and a full CLI/MCP capture remain untested. ## Typed outcome or recovery expected The escaped and ordinary rel values should both project `["mcp"]` and the same hint. Preserve delimiter recognition for quoted commas, semicolons and escaped quotation marks. ## Analysis or suspected cause The tokenizer recognizes backslash escapes while finding delimiters, but the `unquote` helper only strips surrounding quotation marks. It never decodes the quoted-pair. Fixing duplicate parameter precedence alone does not restore this case. ## Additional context Targeted open-issue searches for `CdpSafeMetadata`, `Link anchor`, `Link rel`, `Link duplicate`, and `quoted-pair` found no matching report. Closed issues were not searched. No source changes were made. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The production projection emits incorrect structured metadata for the concrete Link header above, with a discriminating ordinary-header control. - Workaround status: unverified - Workaround basis: The source header can be interpreted manually outside this projection, but no general automated recovery workflow for captured targets was tested.

bsakaguchi closed this issue

2026-10-31 00:45:05 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:44 +00:00

[PR #3902] [MERGED] fix(mcp): declare Frida status session mutation #5960