Android: helper stderr reaches the client error and request log unfiltered

Abierto
  • ¿Algo no está bien?
#4,026 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
android, typescript
Área
mobile, security

Línea de trabajo

Start by tracing how Android snapshot helper stderr becomes the client error reason, details.stderr, and the android_snapshot_helper_failed request-log entry; the issue does not name the relevant files or tests. Inspect the checked-in helper’s stdout status chunks and the remote-provider cause-line behavior. Done means stderr reaching clients or logs is bounded, snapshot-content lines are excluded, and cause lines such as uiautomator unavailable remain visible.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backlog bug

Found while working on #4021 (#4005).

When the Android snapshot helper fails, the helper's stderr goes to the client and to the request log unfiltered:

  • The first stderr line becomes the failure reason, both in the client error and in the android_snapshot_helper_failed request-log entry.
  • The raw details.stderr is attached to the error.

Snapshot text written to the screen can therefore reach the client and the downloadable request log if a tagless hierarchy fragment lands on stderr (for example ret" text="…" />). Remote clients can download that request log. A sensitive fill's literal value is scrubbed only where it matches exactly, so an altered form of it in a fragment is not caught.

The checked-in helper writes XML only through base64 status chunks on stdout, so this needs stderr to carry snapshot content, and no current helper path does that. It is a defense-in-depth gap, not a reproduced leak.

Required behavior. Helper stderr that reaches the client or the request log is bounded, and lines carrying snapshot content are kept out of it. The cause line that remote providers rely on (for example uiautomator unavailable) must stay visible.

Lenguaje dominante
TypeScript
Estrellas
5.2k
Forks
359
Merge medio
13 h 37 min
PR fusionados (30 d)
665

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de callstack/agent-device

Todos los issues de callstack/agent-device

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.