Files
gstack/browse
gstack dcc820f070 fix(stealth): address adversarial code review — 7 findings
1. HIGH — webdriver fallback logic bug: define-then-delete on instance
   re-exposes prototype getter returning true. Fixed: override getter
   directly on Navigator.prototype when delete fails.

2. HIGH — chrome.runtime clobbered unconditionally, breaking extension
   messaging (content scripts, sidepanel, background). Fixed: only stub
   methods that don't already exist (if !w.chrome.runtime.connect ...).

3. MEDIUM — PermissionStatus shape missing EventTarget behavior. Sites
   calling addEventListener on the result would throw. Fixed: create
   object via Object.create(EventTarget.prototype).

4. MEDIUM — Plugin item()/namedItem() returned undefined instead of null
   for missing entries. Detectable and breaks strict checks. Fixed: ?? null.

5. MEDIUM — WebGL params spoofed even without debug extension, which is
   detectable as synthetic. Fixed: check getExtension() first.

6. LOW/MEDIUM — Only toString itself was registered in the WeakMap;
   patched getParameter was still inspectable. Fixed: register all
   patched prototype functions.

7. LOW — Import from playwright-core instead of playwright (transitive
   dependency). Fixed: import from playwright (direct dependency).

All 129 tests pass (54 stealth + 75 existing).
2026-04-21 03:10:13 +00:00
..