Skip to content

fix(macos): bound untrusted diagnostics bridge - #114

Merged
yashranaway merged 2 commits into
mainfrom
t3code/harden-webkit-qa-bridge
Aug 10, 2026
Merged

fix(macos): bound untrusted diagnostics bridge#114
yashranaway merged 2 commits into
mainfrom
t3code/harden-webkit-qa-bridge

Conversation

@yashranaway

Copy link
Copy Markdown
Collaborator

Summary

  • mark diagnostic reports, events, issues, console, and network evidence as untrusted
  • fix WebKit page-bridge provenance in the host and cap it at 500 events per document
  • document the unavoidable page-world observer and advance the wire protocol to 0.5
  • add hostile-page macOS E2E coverage for spoofing and spam truncation

Verification

  • npx --yes pnpm@9.15.0 test:runtime
  • npx --yes pnpm@9.15.0 test:e2e:linux (43/43 protocol tests + Linux P2 E2E)

Fixes #28

@yashranaway yashranaway added the macos-e2e Run the macOS WKWebView E2E suite label Aug 10, 2026
@yashranaway
yashranaway force-pushed the t3code/harden-webkit-qa-bridge branch from 80fd2ba to d3d4d3c Compare August 10, 2026 21:16
@yashranaway
yashranaway merged commit 89b3f5c into main Aug 10, 2026
7 checks passed
@yashranaway
yashranaway deleted the t3code/harden-webkit-qa-bridge branch August 10, 2026 21:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

macos-e2e Run the macOS WKWebView E2E suite

Projects

None yet

Development

Successfully merging this pull request may close these issues.

B8 — QA diagnostics bridge isolation (macOS)

1 participant