mirror of
https://github.com/agent0ai/agent-zero.git
synced 2026-11-11 08:12:25 +00:00
c6b3f56d72
Cross-origin related windows could read page content and invoke DOM actions through the helper's public postMessage channel. Reject foreign and opaque origins, use exact target origins, and bind each pending response to its child window and operation. Preserve inherited origins for about:blank/srcdoc frames and trusted direct automation access. Bump the helper to v2 and require a page reload when legacy listeners are present. Existing host browsers must restart and reconnect before restored tabs reload so old initialization scripts are discarded. Add real-Chromium regressions for parent/frame/opener attacks, opaque origins, forged responses, same-origin actions, and helper upgrades. Validation: 250 browser/connector tests passed in both Conda a0 and Docker's framework runtime; JavaScript syntax and diff checks passed. Restarted the live runtime and verified HTTP health, browser navigation, and the viewer. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| config.py | ||
| connector_runtime.py | ||
| extension_manager.py | ||
| interactive_view.py | ||
| playwright.py | ||
| runtime.py | ||
| selector.py | ||
| url.py | ||