[GH-ISSUE #2530] fix(frida): captured script errors lose supplied source locations #847

New issue

Closed

opened 2026-10-15 18:28:58 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:58 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2530

Summary

Frida can deliver a script error with a file, line, and column independently of its stack text. REA captures the error description and stack but drops those source-location fields from both script-load results and session history. A caller receiving an error without a location in its stack cannot recover the supplied position from the returned Evidence.

Steps to reproduce

Use the tested main revision with fake Frida provider handles. This reproduction exercises message recording without executing instrumentation in a native target.

Start an attach session using a fake local device and PID 512.
Arrange for the fake script's load method to emit the following error on its subscribed message signal, with no binary data:

{"type":"error","description":"boom","stack":"Error: boom","fileName":"agent.js","lineNumber":7,"columnNumber":3}

Load an inline script and inspect the returned message. Read session status and inspect the same message in retained history.
As a control, emit another error containing only type, description, and stack. Its observation should retain those fields without inventing a position.

Runtime or environment

Verified at commit 8b181716ac with Node v26.10.0 and npm 11.19.1, installed lockfile dependencies, and simulated provider handles. The repository pins the optional Frida binding to 17.23.2.

Expected behavior

Captured script-error Evidence should preserve a file, line, and column when the provider supplies them, subject to the existing text bounds and authentication redaction. A location-free error should remain location-free. The provider's structured position should not depend on parsing its optional stack text.

Actual behavior

Both the load result and session history contained the generated script ID, error type, boom description, and Error: boom stack. Neither contained the supplied agent.js, line 7, or column 3. The control error retained its description and stack without a position.

Evidence

Expected source: AGENTS.md, Product and Authority, requires preservation of evidence and metadata; docs/tool-design.md:51 requires facts with source locations; src/contracts/fridaToolContracts.ts:152 promises script errors inline as Evidence. The pinned binding's node_modules/frida/src/frida_bindgen/customization.py:188 defines fileName, lineNumber, and columnNumber as optional error-message fields independently of stack.
Failure source: src/frida/FridaInstrumentationManager.ts:825 constructs the retained observation without any location fields; src/frida/frida-bindings.d.ts:2 also omits them from the adapter's ambient message type. The focused message-recording probe observed their absence in both public manager results.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The focused probe passed its assertions for loss of all three supplied values and the location-free control. The installed binding's type-generation source establishes that the fixture is a supported message shape. A real native Frida session was not run.

Restoration check

Deliver the same error message during a script load. Both the load result and session status should preserve its supplied source position, with the existing redaction and bounded capture behavior intact. Errors lacking position fields should still retain their description and stack without fabricated coordinates, and ordinary send messages should retain their current behavior.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The adapter discards provider-supplied source evidence needed to locate instrumentation errors. The error remains visible, but this valid message has no position in its stack, so its original location is unrecoverable from REA's returned record.
Workaround status: unverified
Workaround basis: Some provider stacks may include a location, but the tested stack does not. No alternative REA result retaining the discarded structured coordinates was found, and rerunning does not guarantee the same observation.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2530 ## Summary Frida can deliver a script error with a file, line, and column independently of its stack text. REA captures the error description and stack but drops those source-location fields from both script-load results and session history. A caller receiving an error without a location in its stack cannot recover the supplied position from the returned Evidence. ## Steps to reproduce Use the tested main revision with fake Frida provider handles. This reproduction exercises message recording without executing instrumentation in a native target. 1. Start an attach session using a fake local device and PID 512. 2. Arrange for the fake script's load method to emit the following error on its subscribed message signal, with no binary data: ```json {"type":"error","description":"boom","stack":"Error: boom","fileName":"agent.js","lineNumber":7,"columnNumber":3} ``` 3. Load an inline script and inspect the returned message. Read session status and inspect the same message in retained history. 4. As a control, emit another error containing only type, description, and stack. Its observation should retain those fields without inventing a position. ## Runtime or environment Verified at commit 8b181716aca2cb467be499cba226abfb5ae19141 with Node v26.10.0 and npm 11.19.1, installed lockfile dependencies, and simulated provider handles. The repository pins the optional Frida binding to 17.23.2. ## Expected behavior Captured script-error Evidence should preserve a file, line, and column when the provider supplies them, subject to the existing text bounds and authentication redaction. A location-free error should remain location-free. The provider's structured position should not depend on parsing its optional stack text. ## Actual behavior Both the load result and session history contained the generated script ID, error type, `boom` description, and `Error: boom` stack. Neither contained the supplied `agent.js`, line 7, or column 3. The control error retained its description and stack without a position. ## Evidence - Expected source: `AGENTS.md`, Product and Authority, requires preservation of evidence and metadata; `docs/tool-design.md:51` requires facts with source locations; `src/contracts/fridaToolContracts.ts:152` promises script errors inline as Evidence. The pinned binding's `node_modules/frida/src/frida_bindgen/customization.py:188` defines fileName, lineNumber, and columnNumber as optional error-message fields independently of stack. - Failure source: `src/frida/FridaInstrumentationManager.ts:825` constructs the retained observation without any location fields; `src/frida/frida-bindings.d.ts:2` also omits them from the adapter's ambient message type. The focused message-recording probe observed their absence in both public manager results. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The focused probe passed its assertions for loss of all three supplied values and the location-free control. The installed binding's type-generation source establishes that the fixture is a supported message shape. A real native Frida session was not run. ## Restoration check Deliver the same error message during a script load. Both the load result and session status should preserve its supplied source position, with the existing redaction and bounded capture behavior intact. Errors lacking position fields should still retain their description and stack without fabricated coordinates, and ordinary send messages should retain their current behavior. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The adapter discards provider-supplied source evidence needed to locate instrumentation errors. The error remains visible, but this valid message has no position in its stack, so its original location is unrecoverable from REA's returned record. - Workaround status: unverified - Workaround basis: Some provider stacks may include a location, but the tested stack does not. No alternative REA result retaining the discarded structured coordinates was found, and rerunning does not guarantee the same observation.

bsakaguchi

2026-10-15 18:28:58 +00:00

closed this issue
added the
area: native

bug
labels

bsakaguchi commented

2026-10-15 18:28:59 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4.

Captured Frida errors retain supplied file, line, and column facts with bounded explicit-secret redaction.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4](https://github.com/morluto/rea/commit/5fa7a52d1f4b28c0b842c5737b84fef6ef2a8eb4). Captured Frida errors retain supplied file, line, and column facts with bounded explicit-secret redaction. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-16 21:16:45 +00:00

[PR #847] [MERGED] fix(artifacts): report which path constraint failed #2285

bsakaguchi referenced this issue

2026-10-17 21:08:23 +00:00

[PR #1081] [CLOSED] fix(artifacts): bound ZIP entry extraction to the 64 MiB per-entry budget #2629

bsakaguchi referenced this issue

2026-10-31 00:40:02 +00:00

[GH-ISSUE #5623] [Bug] JavaScript application analysis drops the selected path and host resolution reason #3407

bsakaguchi referenced this issue

2026-10-31 00:42:48 +00:00

[GH-ISSUE #5991] [Bug] JavaScript application filesystem errors lose errno and path #3658