microlinkhq / browserless / 24029615898

89%

push

github

chore(goto): better autoconsent setup (#712)

* chore(goto): better autoconsent setup

* fix(goto): catch eval errors in autoconsent handler

`page.evaluate(message.code)` can throw (runtime errors, navigation
during evaluation, invalid code) but had no try/catch, so sendMessage
was never called and autoconsent never received the evalResp — stalling
the consent-detection flow.  Fall back to `result: false` on failure,
matching the defensive `.catch(() => {})` pattern already used by
sendMessage.

Made-with: Cursor

* fix(goto): restrict autoconsent eval to main frame via nonce

page.exposeFunction propagates bindings to every frame, including
cross-origin iframes.  A malicious iframe could call
autoconsentSendMessage({type:'eval', code:'…'}) and page.evaluate
would execute that code in the main frame's context, bypassing the
Same-Origin Policy (same pattern as the DuckDuckGo Android UXSS,
CVSS 8.6).

Generate a per-page random nonce and wrap the binding in the top frame
only (window.self === window.top) so every legitimate message carries
it.  Child frames keep the raw CDP binding which lacks the nonce, so
their messages are silently rejected by the handler.

Made-with: Cursor

* fix: timeout setup

480 of 572 branches covered (83.92%)

Branch coverage included in aggregate %.

24 of 27 new or added lines in 1 file covered. (88.89%)

2309 of 2567 relevant lines covered (89.95%)

195178.23 hits per line