morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2767] [MERGED] fix(capture): end special-scheme URL authorities at a backslash #5376

New issue

Closed

opened 2026-10-31 01:06:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:10 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2767
Author: @kaoru0822-kitauji
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/issue-2671

📝 Commits (10+)

553cd6e fix(capture): end special-scheme URL authorities at a backslash
e1fb404 fix(capture): skip special-scheme leading slashes before userinfo
7d972a7 Merge remote-tracking branch 'origin/main' into fix/issue-2671
0266e65 fix(capture): preserve same-scheme relative redirect paths
72e931f chore(ci): retain contributor updates alongside verification fixes
e8361b7 fix(capture): parse URL controls and mixed network authorities
0aff997 fix(capture): distinguish native paths and URL base authorities
4d5d1f5 fix(capture): preserve file-relative path evidence after separators
af2f55c fix(comparison): recheck historical calls-only changes (#2223)
ad16d25 fix(android): make DEX descriptor pattern portable

📊 Changes

2 files changed (+180 additions, -7 deletions)

View changed files

📝 bridge/mitmproxy/capture.py (+89 -7)
📝 bridge/mitmproxy/test_capture.py (+91 -0)

📄 Description

Fixes #2671.

Problem

The native mitmproxy adapter (bridge/mitmproxy/capture.py) removes transport userinfo from Location/Referer/Origin and native request.path/authority with this regex:

^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@

The authority therefore ran to the last @ before /, ? or #. For Location: https://example.test\part@tail, the adapter treated example.test\part as userinfo:

the reported Location became https://tail, a different destination;
the original bytes were withdrawn as a transport-credential redaction (state: "redacted", no content, size or digest).

The shared TypeScript owner, src/domain/recordedTransportUrl.ts, follows WHATWG URL parsing, as HAR captures do. There, a backslash ends the authority of a special scheme (http, https, ws, wss, ftp, file) or a scheme-relative // reference. That @ is ordinary path text, and the HAR projector preserves the value.

Fix

without_userinfo locates the authority with the same boundary rule as recordedTransportUrl.ts:

It ends at /, ? or #, and also at \ for special or scheme-relative references.
It removes userinfo only up to the last @ inside that authority.
Byte values are processed as Latin-1, so every other byte stays identical.

Userinfo before a backslash, as in https://user:pw@example.test\path, is still removed and redacted, and non-special schemes keep their previous behavior. The /authority path handling is unchanged.

Validation

New bridge/mitmproxy/test_capture.py, added to npm run test:python, which CI's static job runs. It stubs the mitmproxy imports and calls the real project_record / without_userinfo:
- https://example.test\part@tail is reported unchanged, with its byte sidecar retained and no redaction. This fails on main, which returns https://tail.
- https://user:pw@example.test\path becomes https://example.test\path, with the transport-credential redaction.
- https://user:pw@example.test/a@b becomes https://example.test/a@b.
- The non-special and scheme-relative boundary cases are covered too.
npm run test:python passes (13 + 11 tests), and so does tests/boundary/filesystem/ciTestReports.test.ts, which checks the test:python wiring. npm run check:fast, metadata:check and format:check pass.
Not run: the real mitmdump 12.2.3 native workflow, which needs Linux and REA_MITMDUMP_COMMAND.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2767 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/issue-2671` --- ### 📝 Commits (10+) - [`553cd6e`](https://github.com/morluto/rea/commit/553cd6e358bdb30c1edfa6b54e453e9bae6fcb0b) fix(capture): end special-scheme URL authorities at a backslash - [`e1fb404`](https://github.com/morluto/rea/commit/e1fb40460d2bf8223cd5fdfd7417dc6635a8396b) fix(capture): skip special-scheme leading slashes before userinfo - [`7d972a7`](https://github.com/morluto/rea/commit/7d972a7e8593f0bb4c58f0d4a4acbb4b5612e5e2) Merge remote-tracking branch 'origin/main' into fix/issue-2671 - [`0266e65`](https://github.com/morluto/rea/commit/0266e6552bea655084da03a9ca87286fe84f80ed) fix(capture): preserve same-scheme relative redirect paths - [`72e931f`](https://github.com/morluto/rea/commit/72e931f3a3d01bd8ee91813b511d9575fe3fcab7) chore(ci): retain contributor updates alongside verification fixes - [`e8361b7`](https://github.com/morluto/rea/commit/e8361b77157f5ad31627f9e45ed05c013e60e109) fix(capture): parse URL controls and mixed network authorities - [`0aff997`](https://github.com/morluto/rea/commit/0aff997b31d7125b6aa86f33475e29dd57be2d55) fix(capture): distinguish native paths and URL base authorities - [`4d5d1f5`](https://github.com/morluto/rea/commit/4d5d1f5daa332cbffc9e3bcdc6a159d2ac8d0ec2) fix(capture): preserve file-relative path evidence after separators - [`af2f55c`](https://github.com/morluto/rea/commit/af2f55cda9b8b8904f0f29f4367df09a60c6067f) fix(comparison): recheck historical calls-only changes (#2223) - [`ad16d25`](https://github.com/morluto/rea/commit/ad16d250e366ba7f13f80a56e75c6b8c3f2edaf1) fix(android): make DEX descriptor pattern portable ### 📊 Changes **2 files changed** (+180 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `bridge/mitmproxy/capture.py` (+89 -7) 📝 `bridge/mitmproxy/test_capture.py` (+91 -0) </details> ### 📄 Description Fixes #2671. ## Problem The native mitmproxy adapter (`bridge/mitmproxy/capture.py`) removes transport userinfo from `Location`/`Referer`/`Origin` and native `request.path`/`authority` with this regex: ``` ^([\x00-\x20]*(?:[a-z][a-z0-9+.-]*:)?//)[^/?#]*@ ``` The authority therefore ran to the last `@` before `/`, `?` or `#`. For `Location: https://example.test\part@tail`, the adapter treated `example.test\part` as userinfo: - the reported Location became `https://tail`, a different destination; - the original bytes were withdrawn as a `transport-credential` redaction (`state: "redacted"`, no content, size or digest). The shared TypeScript owner, `src/domain/recordedTransportUrl.ts`, follows WHATWG URL parsing, as HAR captures do. There, a backslash ends the authority of a special scheme (`http`, `https`, `ws`, `wss`, `ftp`, `file`) or a scheme-relative `//` reference. That `@` is ordinary path text, and the HAR projector preserves the value. ## Fix `without_userinfo` locates the authority with the same boundary rule as `recordedTransportUrl.ts`: - It ends at `/`, `?` or `#`, and also at `\` for special or scheme-relative references. - It removes userinfo only up to the last `@` inside that authority. - Byte values are processed as Latin-1, so every other byte stays identical. Userinfo before a backslash, as in `https://user:pw@example.test\path`, is still removed and redacted, and non-special schemes keep their previous behavior. The `/authority` path handling is unchanged. ## Validation - New `bridge/mitmproxy/test_capture.py`, added to `npm run test:python`, which CI's static job runs. It stubs the `mitmproxy` imports and calls the real `project_record` / `without_userinfo`: - `https://example.test\part@tail` is reported unchanged, with its byte sidecar retained and no redaction. This fails on main, which returns `https://tail`. - `https://user:pw@example.test\path` becomes `https://example.test\path`, with the `transport-credential` redaction. - `https://user:pw@example.test/a@b` becomes `https://example.test/a@b`. - The non-special and scheme-relative boundary cases are covered too. - `npm run test:python` passes (13 + 11 tests), and so does `tests/boundary/filesystem/ciTestReports.test.ts`, which checks the `test:python` wiring. `npm run check:fast`, `metadata:check` and `format:check` pass. - Not run: the real mitmdump 12.2.3 native workflow, which needs Linux and `REA_MITMDUMP_COMMAND`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:10 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:58 +00:00

[PR #5376] [CLOSED] fix(gdb): keep a failed startup's retained owner closed #6908

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5376

No description provided.

Rows
Columns