Surface URLs from the operator's config are echoed verbatim, credentials included
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- security
Research direction
Start by locating the config parsing and the handling of gap.ref, screen.url, and coverage.affected[].url in the repository. Trace how those URLs reach the pull request comment, then check how exact URL matching attributes gaps to screens. Done means URLs containing userinfo are rejected with an error naming the field but not the value, and gap.ref remains the configured URL after parsing; the issue also raises whether query strings should trigger a warning.
Written by the indexing model from the issue text.
Description
What
gap.ref, screen.url, and coverage.affected[].url carry the configured surface URL unchanged into every surface, including the pull request comment. A URL written into usabl.config.json with userinfo, a token in the query, or a fragment is published as written.
Why it matters
These are operator inputs rather than page text, so this is not the same class as page-derived leakage, but a credential in a config URL should never reach a pull request comment.
Direction
Strip userinfo at config parse time and refuse a surface URL that carries one, with a message that names the field and not the value. Consider warning on a query string in a surface URL. Keep gap.ref equal to the configured URL after parsing, because the overlay attributes gaps to screens by exact URL match.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- Avg merge
- 2h 48m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from usabl-dev/usabl
-
area: engine bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Stop hook allows a stop on an unknown verdict, and the self-check prints IDLE for a null verdictOpenarea: assistants bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
area: engine bug security
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Overlay: browser context failures are counted per plugin, not per browser, and close is not sharedOpenarea: overlay bug
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
area: engine enhancement performance
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 76/100
logto-io/logto#9837 · 1 comment ·
Maintainers usually reply within 1 day
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
lingdojo/kana-dojo#32964 · 1 comment · 5 reactions ·
Maintainers usually reply within 1 day
-
Documentation status: needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
mastra-ai/mastra#28194 · 1 comment ·
Maintainers usually reply within 1 day
-
priority-low refactor-3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 3 days