[GH-ISSUE #7395] [Bug] HAR capture previews include nested payloads from unknown name and type extensions #4399

New issue

Closed

opened 2026-10-31 00:49:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:30 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7395

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

After importing a valid one-entry HAR, inspect-analysis-view with kind: "capture", detail: "preview" returns nested extension objects from the entry's name and type properties. Both contain a synthetic payload marker. The complete-page control also retains the extensions; ordinary response body content is correctly absent from preview.

Reproduction

From a fresh checkout at the revision below with Node 24.22.1, prepare the built runtime with npm ci && npm run build:cached. Then run this offline fixture and CLI sequence. I ran the capture and both view commands once; each exited 0.

WORK=$(mktemp -d)
mkdir -p "$WORK"/{home,config,data,cache,state,tmp}
export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/tmp"
cat > "$WORK/capture.har" <<'JSON'
{"log":{"version":"1.2","creator":{"name":"fixture","version":"1"},"entries":[{"startedDateTime":"2026-10-07T13:00:00.123Z","time":1.25,"name":{"payload":"PREVIEW-PAYLOAD-MARKER"},"type":{"body":"PREVIEW-PAYLOAD-MARKER"},"request":{"method":"GET","url":"https://example.test/a","httpVersion":"HTTP/2","cookies":[],"headers":[],"queryString":[],"headersSize":-1,"bodySize":0},"response":{"status":200,"statusText":"OK","httpVersion":"HTTP/2","cookies":[],"headers":[],"content":{"size":3,"mimeType":"text/plain","text":"abc"},"redirectURL":"","headersSize":-1,"bodySize":3},"cache":{},"timings":{"send":0,"wait":1.25,"receive":0}}]}}
JSON
node scripts/rea.mjs inspect-web-network-capture "$WORK/capture.har" har --json > "$WORK/capture.json"
node -e 'const fs=require("fs");const e=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));for(const detail of ["preview","complete"])fs.writeFileSync(process.argv[2]+"/"+detail+"-request.json",JSON.stringify({source:{kind:"inline",evidence:e},view:{kind:"capture",detail,offset:0,limit:1}}))' "$WORK/capture.json" "$WORK"
node scripts/rea.mjs inspect-analysis-view "$WORK/preview-request.json" --json > "$WORK/preview.json"
node scripts/rea.mjs inspect-analysis-view "$WORK/complete-request.json" --json > "$WORK/complete.json"
node -e 'const fs=require("fs");for(const detail of ["preview","complete"]){const e=JSON.parse(fs.readFileSync(process.argv[1]+"/"+detail+".json","utf8"));console.log(detail+": "+JSON.stringify(e.normalized_result.items[0].reported));}' "$WORK"

Expected behavior

Preview should omit these nested unknown HAR extension payloads while retaining legitimate HAR headlines and timestamps. Complete pages should retain the original extensions. docs/web-network-captures.md:42-56 promises preview pages omit payload content and explicitly documents this inline-Evidence CLI workflow; lines 69-70 preserve unknown HAR extensions as reported Evidence.

Impact and scope

P2: valid capture input produces a payload-bearing preview despite its documented selection contract. The demonstrated effect is unwanted nested content in output, with complete source facts preserved. A caller can remove these two fields from its local preview result while retaining the original Evidence. No large-input behavior, context exhaustion, credential disclosure or live-target effect was observed; prevalence in real producer captures is unknown.

REA version

Exact node scripts/rea.mjs --version output: 6.8.0. Source commit: 319fee4691e444d5ac9870f114f93f79ef89707b.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; Darwin arm64, measured locally. No external analysis provider ran.

Target and artifact context

Synthetic HAR 1.2 with one HTTP entry, unknown object-valued name and type extensions, and a three-character response body. The example URL is never contacted.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Observed preview output, obtained by the final command above:

preview: {"name":{"payload":"PREVIEW-PAYLOAD-MARKER"},"time":1.25,"startedDateTime":"2026-10-07T13:00:00.123Z","type":{"body":"PREVIEW-PAYLOAD-MARKER"},"request":{"method":"GET","url":"https://example.test/a","httpVersion":"HTTP/2"},"response":{"httpVersion":"HTTP/2","status":200,"statusText":"OK"}}

The complete control contains the same two extension objects plus the original request/response fields, including response.content.text: "abc". The preview does not contain abc. The existing focused check npx vitest run src/domain/analysisView/webNetworkCaptureView.test.ts passed all 51 tests; it does not cover this extension case.

Analysis or suspected cause

Source-derived at the stated commit: src/browser/history/HarCapture.ts:34-62 validates and retains entry extensions. src/domain/analysisView/webNetworkCaptureView.ts:374-378 then copies session_id, name, time, startedDateTime and type without format or value-shape checks. A nested HAR extension under one of those names passes through unchanged.

Additional context

Related closed reports concern different contracts: #6890 covers malformed HAR timings, #6044 covers grouping-view diagnostics, and #3960 covers nesting admission. No matching open report was found. Proposed restoration checks, not executed fixes: omit these objects only from HAR previews, preserve complete pages and HAR timestamps/headlines, and preserve genuine qlog event names and native mitmproxy flow types. Retained-session MCP delivery and other platforms were not exercised.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7395 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior After importing a valid one-entry HAR, `inspect-analysis-view` with `kind: "capture", detail: "preview"` returns nested extension objects from the entry's `name` and `type` properties. Both contain a synthetic payload marker. The complete-page control also retains the extensions; ordinary response body content is correctly absent from preview. ## Reproduction From a fresh checkout at the revision below with Node 24.22.1, prepare the built runtime with `npm ci && npm run build:cached`. Then run this offline fixture and CLI sequence. I ran the capture and both view commands once; each exited 0. ```sh WORK=$(mktemp -d) mkdir -p "$WORK"/{home,config,data,cache,state,tmp} export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/tmp" cat > "$WORK/capture.har" <<'JSON' {"log":{"version":"1.2","creator":{"name":"fixture","version":"1"},"entries":[{"startedDateTime":"2026-10-07T13:00:00.123Z","time":1.25,"name":{"payload":"PREVIEW-PAYLOAD-MARKER"},"type":{"body":"PREVIEW-PAYLOAD-MARKER"},"request":{"method":"GET","url":"https://example.test/a","httpVersion":"HTTP/2","cookies":[],"headers":[],"queryString":[],"headersSize":-1,"bodySize":0},"response":{"status":200,"statusText":"OK","httpVersion":"HTTP/2","cookies":[],"headers":[],"content":{"size":3,"mimeType":"text/plain","text":"abc"},"redirectURL":"","headersSize":-1,"bodySize":3},"cache":{},"timings":{"send":0,"wait":1.25,"receive":0}}]}} JSON node scripts/rea.mjs inspect-web-network-capture "$WORK/capture.har" har --json > "$WORK/capture.json" node -e 'const fs=require("fs");const e=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));for(const detail of ["preview","complete"])fs.writeFileSync(process.argv[2]+"/"+detail+"-request.json",JSON.stringify({source:{kind:"inline",evidence:e},view:{kind:"capture",detail,offset:0,limit:1}}))' "$WORK/capture.json" "$WORK" node scripts/rea.mjs inspect-analysis-view "$WORK/preview-request.json" --json > "$WORK/preview.json" node scripts/rea.mjs inspect-analysis-view "$WORK/complete-request.json" --json > "$WORK/complete.json" node -e 'const fs=require("fs");for(const detail of ["preview","complete"]){const e=JSON.parse(fs.readFileSync(process.argv[1]+"/"+detail+".json","utf8"));console.log(detail+": "+JSON.stringify(e.normalized_result.items[0].reported));}' "$WORK" ``` ## Expected behavior Preview should omit these nested unknown HAR extension payloads while retaining legitimate HAR headlines and timestamps. Complete pages should retain the original extensions. `docs/web-network-captures.md:42-56` promises preview pages omit payload content and explicitly documents this inline-Evidence CLI workflow; lines 69-70 preserve unknown HAR extensions as reported Evidence. ## Impact and scope P2: valid capture input produces a payload-bearing preview despite its documented selection contract. The demonstrated effect is unwanted nested content in output, with complete source facts preserved. A caller can remove these two fields from its local preview result while retaining the original Evidence. No large-input behavior, context exhaustion, credential disclosure or live-target effect was observed; prevalence in real producer captures is unknown. ## REA version Exact `node scripts/rea.mjs --version` output: `6.8.0`. Source commit: `319fee4691e444d5ac9870f114f93f79ef89707b`. ## Runtime and platform Node.js `v24.22.1`; macOS `27.0.1`; `Darwin arm64`, measured locally. No external analysis provider ran. ## Target and artifact context Synthetic HAR 1.2 with one HTTP entry, unknown object-valued `name` and `type` extensions, and a three-character response body. The example URL is never contacted. ## Interface CLI ## Earliest failure stage Transport or result projection ## Relevant output or evidence Observed preview output, obtained by the final command above: ```text preview: {"name":{"payload":"PREVIEW-PAYLOAD-MARKER"},"time":1.25,"startedDateTime":"2026-10-07T13:00:00.123Z","type":{"body":"PREVIEW-PAYLOAD-MARKER"},"request":{"method":"GET","url":"https://example.test/a","httpVersion":"HTTP/2"},"response":{"httpVersion":"HTTP/2","status":200,"statusText":"OK"}} ``` The complete control contains the same two extension objects plus the original request/response fields, including `response.content.text: "abc"`. The preview does not contain `abc`. The existing focused check `npx vitest run src/domain/analysisView/webNetworkCaptureView.test.ts` passed all 51 tests; it does not cover this extension case. ## Analysis or suspected cause Source-derived at the stated commit: `src/browser/history/HarCapture.ts:34-62` validates and retains entry extensions. `src/domain/analysisView/webNetworkCaptureView.ts:374-378` then copies `session_id`, `name`, `time`, `startedDateTime` and `type` without format or value-shape checks. A nested HAR extension under one of those names passes through unchanged. ## Additional context Related closed reports concern different contracts: [#6890](https://github.com/morluto/rea/issues/6890) covers malformed HAR timings, [#6044](https://github.com/morluto/rea/issues/6044) covers grouping-view diagnostics, and [#3960](https://github.com/morluto/rea/issues/3960) covers nesting admission. No matching open report was found. Proposed restoration checks, not executed fixes: omit these objects only from HAR previews, preserve complete pages and HAR timestamps/headlines, and preserve genuine qlog event names and native mitmproxy flow types. Retained-session MCP delivery and other platforms were not exercised.

bsakaguchi closed this issue

2026-10-31 00:49:30 +00:00

bsakaguchi referenced this issue

2026-11-01 21:43:12 +00:00

[PR #5207] [MERGED] feat(artifacts): triage desktop installation directories #6813