Unverified sandbox items from the Oct 11 audit: proxy checks only the TLS name, and stacked drive-letter definitions
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Read src/main/tools/net_proxy.ts:222-230 and native/sandbox-helper/src/win.rs, then verify both reported behaviors: the proxy's handling of CONNECT and TLS ClientHello extensions, and how QueryDosDeviceW definitions are checked. The issue proposes documenting the proxy limit or refusing ECH, and comparing only the first drive mapping entry; completion means both findings are verified and the chosen fixes prevent the described behavior.
Written by the indexing model from the issue text.
Description
Found in the Oct 11 audit (at c5f5641). Both need verification.
- The allow-list proxy checks only the TLS server name (
src/main/tools/net_proxy.ts:222-230). A CONNECT to an allowed host on a shared CDN can sendHost: other-siteinside TLS (domain fronting), and Encrypted Client Hello hides the real name behind the CDN's public name. Fix: document the limit, or refuse a ClientHello that carries an ECH extension (0xfe0d). DriveMapping::is_liveaccepts any entry of a drive letter's definition stack (native/sandbox-helper/src/win.rs, added in 68dd655).QueryDosDeviceWreturns every stacked definition, and.any(...)accepts the expected target even when another definition sits on top, soProjectDrive::defineskipsDefineDosDeviceWand the run starts in the wrong folder. Correctness only: access is still governed by ACLs. Fix: compare only the first entry.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 5h 28m
- Merged PRs (30d)
- 24
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
Claude Code chats: tool calls made inside Claude Code subagents leave cards that end as "(stopped)"Openbug priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
PierrunoYT/patch#289 ·
Maintainers usually reply within 1 day
-
bug priority: medium severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#285 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PierrunoYT/patch#283 ·
Maintainers usually reply within 1 day
-
enhancement priority: medium security severity: medium
Difficulty 5/5 Over a week Newbie friendliness 35/100
PierrunoYT/patch#294 ·
Maintainers usually reply within 1 day
-
priority: low security severity: low
Difficulty 3/5 1-2 days Newbie friendliness 67/100
PierrunoYT/patch#292 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
area:tui enhancement platform:macos
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
anthropics/claude-code#101490 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
netlify/netlify-mcp#75 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
atlassian-labs/compiled#1960 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
pnp/cli-microsoft365#7639 ·
Maintainers usually reply within 2 days
-
nextjs-tracking
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
cloudflare/vinext#3887 ·
Maintainers usually reply within 1 day