From 1c2e56ddd25833acb9d580bc87e5f425967d255a Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 4 Apr 2026 21:18:18 -0700 Subject: [PATCH] fix: validate saved URLs before navigation in restoreState Cherry-pick PR #751 by @Gonzih. Prevents navigation to cloud metadata endpoints or file:// URIs embedded in user-writable state files. Co-Authored-By: Gonzih Co-Authored-By: Claude Opus 4.6 (1M context) --- browse/src/browser-manager.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/browse/src/browser-manager.ts b/browse/src/browser-manager.ts index ef476248..3a7a106c 100644 --- a/browse/src/browser-manager.ts +++ b/browse/src/browser-manager.ts @@ -822,7 +822,15 @@ export class BrowserManager { this.wirePageEvents(page); if (saved.url) { - await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {}); + // Validate the saved URL before navigating — the state file is user-writable and + // a tampered URL could navigate to cloud metadata endpoints or file:// URIs. + try { + await validateNavigationUrl(saved.url); + await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {}); + } catch { + // Invalid URL in saved state — skip navigation, leave blank page + console.log(`[browse] restoreState: skipping unsafe URL: ${saved.url}`); + } } if (saved.storage) {