A link between two HTML artifacts of a private repository opens for the operator (v1.43.4) #164
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mi/werkator#164
Reference in New Issue
Block a user
Bug report from vm4006: every link inside the scenario report of hs.hsadmin.ng answers 404, because the sandboxed artifact navigates cross-site and the SameSite=Strict control-token cookie stays behind. See docs/prs/.
🤖 Generated with Claude Code
🟡 werkrevisor YELLOW for
fb6ebec, superseded by the result for09e9741🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
SameSite=StricttoSameSite=Laxweakens RFC 0003 D8 — a foreign page visited by an authenticated operator can now open private pages and use timing or frame-counting to probe whether a private repository of a given name exists. The PR document acknowledges this trade-off and presents the alternatives (path-scoped cookies, signed URLs) …Findings
docs/prs/2026-10-17-PR#164-artifact-links-private-repos.md:76-80, YELLOW, as a line commentClassifier
4 of 7 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 19582, calls 1, tokens in 18801 / out 8693 (reasoning included in out), duration 100.9 s, cost 0.0160 USD (reported), classifier `jev-1.13.0` calls 7, tokens in 6020, cost 0.0003 USD, finding judge `jev-1.13.0` calls 1, tokens in 2357, cost 0.0001 USD, excerpt selection `openrouter/openai/gpt-6-luna` calls 2, tokens in 65523 / out 509, cost 0.0084 USD (reported), build file judge `jev-1.13.0` calls 3, tokens in 3881, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 10.4 s, model_review 89.2 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main06e29e8).Reviewed head `fb6ebec64f4bd78b265352608f08ea6dbfda69ee` against base `06e29e871da52815f88dd78e347b07cf0e6b02c0`, werkrevisor 0.48.0.
werkrevisor: YELLOW / HUMAN_REVIEW for
fb6ebec64f4bd78b265352608f08ea6dbfda69ee.The result comment of werkrevisor holds the details.
@@ -0,0 +73,4 @@It cannot read the answer, because the page is cross-origin to it.- A script in a sandboxed artifact has an opaque origin: it cannot read `document.cookie` or `localStorage` of Werkator,and its `fetch` or `iframe` requests to Werkator are cross-site subresource requests, which do not carry a Lax cookie.- Residual risk, new with Lax: a foreign page can open a private page in the operator's browser and time it,[medium] D8 Weakening Trade-off (werkrevisor)
YELLOW; Jev: real 0.53, severity 3.0 of 3
The change from
SameSite=StricttoSameSite=Laxweakens RFC 0003 D8: a foreign page can now open a private repository page in the operator's browser and use timing or frame-counting to tell a 200 from a 404, thereby guessing whether a private repository of a given name exists. The PR document explicitly discusses this trade-off (lines 76–80) and notes that the alternatives (a path-scoped artifact cookie or signed artifact URLs) cost a server-side token per artifact. The change is deliberate, minimal, and documented, but it weakens a documented privacy guarantee and therefore deserves focused reviewer attention rather than routine approval.Not changed: the trade-off is deliberate and documented under "Solution". Whether the residual risk to D8 is acceptable is the decision of the human at approval. The scenarios are rewritten as behaviour in
09e9741.⚠️ werkrevisor ERROR for
?, superseded by the result for09e9741Codex review: critical
Changing the private-content authorization cookie from SameSite=Strict to Lax changes a security boundary and requires human review. The documented cross-site information-disclosure risk is not covered by the source-text tests.
No findings.
The merge waits for the status
Model `gpt-6-astra`, effort high, tokens in 204798 (cached 164992) / out 1119, 44.1 s, 10 commands; reviewed head `fb6ebec64f4bd78b265352608f08ea6dbfda69ee`.ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Classifier
7 of 7 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 20169, calls 1, tokens in 19371 / out 20599 (reasoning included in out), duration 131.8 s, cost 0.0305 USD (reported), classifier `jev-1.13.0` calls 7, tokens in 6028, cost 0.0003 USD, excerpt selection `openrouter/openai/gpt-6-luna` calls 2, tokens in 65523 / out 542, cost 0.0009 USD (reported), build file judge `jev-1.13.0` calls 3, tokens in 3881, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 8.7 s, model_review 121.9 s, config: defaults + host + repository (.werkrevisor.toml at main2 answers ignored because of a confidence below [classifier] min_confidence.
06e29e8).Reviewed head `09e9741f523690f8ced4009776d36b5633219e6f` against base `06e29e871da52815f88dd78e347b07cf0e6b02c0`, werkrevisor 0.48.0.
Codex review: critical
Changing the control-token cookie from SameSite=Strict to Lax changes the authorization boundary for private repository content and requires human review. The added source-text tests cannot establish browser-level security, including the cross-site information-disclosure risk acknowledged in the PR documentation.
No findings.
The merge waits for the status
Model `gpt-6-astra`, effort high, tokens in 145739 (cached 110464) / out 1001, 38.9 s, 6 commands; reviewed head `09e9741f523690f8ced4009776d36b5633219e6f`.ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.