morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6964] [Bug] Repeated Content-Security-Policy and Referrer-Policy headers lose policy facts #4250

New issue

Closed

opened 2026-10-31 00:48:05 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:48:05 +00:00

Owner

Originally created by @Adolanium on GitHub (Oct 24, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6964

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

When a response repeats Content-Security-Policy on several header field lines, the browser response metadata lists the first policy's directives but drops the first directive of each later policy. A repeated Referrer-Policy is reported as null instead of the effective policy.

Reproduction

Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main d87e73f2d, through safeResponseMetadata in a test, with headers shaped as CDP reports repeated field lines (joined with LF):

Content-Security-Policy: "default-src 'self'\nscript-src https://private.example.test; img-src data:": csp.directives has no script-src directive.
Referrer-Policy: "no-referrer\nstrict-origin": policies.referrer_policy is null.

Expected behavior

Every directive of every CSP policy is listed, and referrer_policy is strict-origin.

Impact and scope

Page inspection and session observation under-report the CSP and referrer policy of responses that repeat these headers, which affects analysis of script sources and policy differences.

REA version

6.7.0, revision d87e73f2d

Runtime and platform

Linux (WSL Ubuntu), Node 24.22.1

Target and artifact context

Synthetic CDP response headers; no real site.

Interface

MCP

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Root cause and fix are in #6963, with the regression tests.

Typed outcome or recovery expected

No new error.

Analysis or suspected cause

Root cause and fix are in #6963.

Additional context

Fixed by #6963.

Originally created by @Adolanium on GitHub (Oct 24, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6964 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior When a response repeats `Content-Security-Policy` on several header field lines, the browser response metadata lists the first policy's directives but drops the first directive of each later policy. A repeated `Referrer-Policy` is reported as `null` instead of the effective policy. ### Reproduction Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main d87e73f2d, through `safeResponseMetadata` in a test, with headers shaped as CDP reports repeated field lines (joined with LF): 1. `Content-Security-Policy: "default-src 'self'\nscript-src https://private.example.test; img-src data:"`: `csp.directives` has no `script-src` directive. 2. `Referrer-Policy: "no-referrer\nstrict-origin"`: `policies.referrer_policy` is `null`. ### Expected behavior Every directive of every CSP policy is listed, and `referrer_policy` is `strict-origin`. ### Impact and scope Page inspection and session observation under-report the CSP and referrer policy of responses that repeat these headers, which affects analysis of script sources and policy differences. ### REA version 6.7.0, revision `d87e73f2d` ### Runtime and platform Linux (WSL Ubuntu), Node 24.22.1 ### Target and artifact context Synthetic CDP response headers; no real site. ### Interface MCP ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Root cause and fix are in #6963, with the regression tests. ### Typed outcome or recovery expected No new error. ### Analysis or suspected cause Root cause and fix are in #6963. ### Additional context Fixed by #6963.

bsakaguchi closed this issue

2026-10-31 00:48:06 +00:00

bsakaguchi commented

2026-10-31 00:48:06 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 24, 2026):

Confirmed as a real reporting gap: with repeated field lines the response metadata currently collapses to the first policy, which under-reports script-src for later policies and turns a repeated Referrer-Policy into null. Worth noting for reviewers: RFC 9110 field-line handling would merge same-name header lines, but for CSP specifically that is not what browsers do — multiple Content-Security-Policy header fields are kept as separate policies and enforced cumulatively, so keeping each directive per policy (as #6963 does) matches browser semantics better than naive merging. The regression tests in #6963 covering multi-policy and repeated Referrer-Policy cases are a good addition.

@XinwangTao commented on GitHub (Oct 24, 2026): Confirmed as a real reporting gap: with repeated field lines the response metadata currently collapses to the first policy, which under-reports script-src for later policies and turns a repeated Referrer-Policy into null. Worth noting for reviewers: RFC 9110 field-line handling would merge same-name header lines, but for CSP specifically that is not what browsers do — multiple Content-Security-Policy header fields are kept as separate policies and enforced cumulatively, so keeping each directive per policy (as #6963 does) matches browser semantics better than naive merging. The regression tests in #6963 covering multi-policy and repeated Referrer-Policy cases are a good addition.

bsakaguchi commented

2026-10-31 00:48:07 +00:00

Author

Owner

@Adolanium commented on GitHub (Oct 24, 2026):

Thanks. One precision for reviewers: #6963 keeps every directive of every policy, in order, but the response schema does not record which policy each directive came from, so csp.directives can list the same directive name once per policy. Recording policy boundaries would need a schema change, which this fix leaves out.

@Adolanium commented on GitHub (Oct 24, 2026): Thanks. One precision for reviewers: #6963 keeps every directive of every policy, in order, but the response schema does not record which policy each directive came from, so `csp.directives` can list the same directive name once per policy. Recording policy boundaries would need a schema change, which this fix leaves out.

bsakaguchi commented

2026-10-31 00:48:07 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 24, 2026):

修复方向认可：CSP 多个 header field 按浏览器语义应作为独立策略累积执行，#6963 保留每条 directive 比 RFC 9110 的 naive 合并更准确，多策略下 script-src 不再被吞是实打实的改进。Adolanium 提到的 schema 局限（不记录 directive 来源策略）对多数审计场景影响有限，但若将来要按策略精确归因（如复现逐策略强制逻辑），确实值得考虑加 policy 边界字段。另外建议在回归测试中显式断言 Referrer-Policy 重复行时取首个有效值（strict-origin），防止后续改动回退到 null。

@XinwangTao commented on GitHub (Oct 24, 2026): 修复方向认可：CSP 多个 header field 按浏览器语义应作为独立策略累积执行，#6963 保留每条 directive 比 RFC 9110 的 naive 合并更准确，多策略下 script-src 不再被吞是实打实的改进。Adolanium 提到的 schema 局限（不记录 directive 来源策略）对多数审计场景影响有限，但若将来要按策略精确归因（如复现逐策略强制逻辑），确实值得考虑加 policy 边界字段。另外建议在回归测试中显式断言 Referrer-Policy 重复行时取首个有效值（strict-origin），防止后续改动回退到 null。

bsakaguchi referenced this issue

2026-10-31 01:12:17 +00:00

[PR #4281] [CLOSED] fix(electron): unwrap asserted inline window options #6155

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4250

No description provided.

Rows
Columns