microlinkhq / browserless / 24029615898 / 1

73%

master: 73%

push

github

chore(goto): better autoconsent setup (#712)

* chore(goto): better autoconsent setup

* fix(goto): catch eval errors in autoconsent handler

`page.evaluate(message.code)` can throw (runtime errors, navigation
during evaluation, invalid code) but had no try/catch, so sendMessage
was never called and autoconsent never received the evalResp — stalling
the consent-detection flow.  Fall back to `result: false` on failure,
matching the defensive `.catch(() => {})` pattern already used by
sendMessage.

Made-with: Cursor

* fix(goto): restrict autoconsent eval to main frame via nonce

page.exposeFunction propagates bindings to every frame, including
cross-origin iframes.  A malicious iframe could call
autoconsentSendMessage({type:'eval', code:'…'}) and page.evaluate
would execute that code in the main frame's context, bypassing the
Same-Origin Policy (same pattern as the DuckDuckGo Android UXSS,
CVSS 8.6).

Generate a per-page random nonce and wrap the binding in the top frame
only (window.self === window.top) so every legitimate message carries
it.  Child frames keep the raw CDP binding which lacks the nonce, so
their messages are silently rejected by the handler.

Made-with: Cursor

* fix: timeout setup

98 of 128 branches covered (76.56%)

Branch coverage included in aggregate %.

487 of 530 relevant lines covered (91.89%)

14.33 hits per line