stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Keep mobile share-target content out of navigation URLs #903

New Issue
Closed
opened 2026-08-15 15:50:54 +00:00 by timmy · 0 comments
timmy commented 2026-08-15 15:50:54 +00:00
Owner
Copy Link

Problem

The installed PWA share target currently redirects shared title, text, and source URL through dashboard and login query strings. Sensitive capture content can therefore enter browser history, proxy logs, and referrers. The generic root POST handler also accepts cross-site navigation posts and deletes a previously staged image before validating the replacement.

Slice

Use a dedicated share-target path, reject explicitly cross-site submissions without touching staged data, stage metadata and accepted images as one bounded IndexedDB bundle, and redirect with only an opaque launch=new&shared=bundle marker. Preserve signed-out sign-in continuation and one-time bundle consumption.

Acceptance

  • Manifest posts only to the dedicated share-target route.
  • Explicit cross-site share-target POST returns 403 and cannot overwrite an existing bundle.
  • Redirect/login URLs contain no shared title, text, source URL, filenames, or blob content.
  • Metadata and ordered images survive sign-in and are consumed once.
  • Invalid/oversized submissions preserve any existing staged bundle.
  • Focused behavioral tests and full suite pass.

Evidence: frontend/manifest.webmanifest, frontend/service-worker.js, frontend/shared-image-capture.js, frontend/dashboard.js, and auth continuation tests. Historical issue/PR title audit found no equivalent share-target admission or URL-confidentiality work; prior #739/#740 and #741/#742 implemented sharing and sign-in preservation only.

## Problem The installed PWA share target currently redirects shared title, text, and source URL through dashboard and login query strings. Sensitive capture content can therefore enter browser history, proxy logs, and referrers. The generic root POST handler also accepts cross-site navigation posts and deletes a previously staged image before validating the replacement. ## Slice Use a dedicated share-target path, reject explicitly cross-site submissions without touching staged data, stage metadata and accepted images as one bounded IndexedDB bundle, and redirect with only an opaque `launch=new&shared=bundle` marker. Preserve signed-out sign-in continuation and one-time bundle consumption. ## Acceptance - Manifest posts only to the dedicated share-target route. - Explicit cross-site share-target POST returns 403 and cannot overwrite an existing bundle. - Redirect/login URLs contain no shared title, text, source URL, filenames, or blob content. - Metadata and ordered images survive sign-in and are consumed once. - Invalid/oversized submissions preserve any existing staged bundle. - Focused behavioral tests and full suite pass. Evidence: `frontend/manifest.webmanifest`, `frontend/service-worker.js`, `frontend/shared-image-capture.js`, `frontend/dashboard.js`, and auth continuation tests. Historical issue/PR title audit found no equivalent share-target admission or URL-confidentiality work; prior #739/#740 and #741/#742 implemented sharing and sign-in preservation only.
timmy self-assigned this 2026-08-15 15:50:54 +00:00
timmy closed this issue 2026-08-15 16:06:29 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#903
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?