Repository navigation
Serve CID and user content in an opaque sandbox, never as Home #168
Description
Part of #173 (isolation plan).
The gateway serves CID content (/s/:cid, /ipfs/:cid, /content/:cid) and site paths (/*path) on the same origin as Home, with no Content-Security-Policy or sandbox (elastos-server/src/api/gateway.rs:1234-1242; no CSP in api/gateway_site.rs). Script in any such page runs as Home's origin: it passes Home's exact-origin check and carries Home's SameSite=Strict cookie. On the public seed anyone can link a visitor to such a page. Serving untrusted content from a separate origin follows in #177.
Done means
- Every CID and user-content document response (HTML, SVG, XML and other types a browser can run script in) carries
Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups(opaque origin, no Home cookie, no same-origin API), and the operator's own site still works. - Regression test: a CID page and a site page cannot call any Home or app API (request refused) and cannot read Home's cookie.
Activity
andersalm commentedon Oct 1, 2026
In progress: #168 isolates CID and user-site pages; base/target develop at c9205a7 (tree b219a667c6eb677447378c437146ccc5d393191a).
Scope: gateway content responses and refused-case regressions; authority additions follow #173 approval.
Proof planned: response coverage, browser cookie/API refusal, operator-site load, and repo basic gates; historical LIB-14 and DEP-06 remain evidence inputs.
Review: at most two rounds; request irzhywau after checks pass and merge after his approval; PR pending.
Next: #169 after #168 merge; #172 design follows both merges.
andersalm commentedon Oct 1, 2026
In progress: #168 groups CID and user-site routes under one response sandbox on develop base c9205a7; PR pending.
The policy keeps scripts, forms and popups in an opaque origin; connect-src blocks script API calls because existing app CORS accepts null origins.
Regression work covers aliases, cached/provider responses, cookie and API refusal, unchanged content bytes, and the operator website; historical LIB-14/DEP-06 stay separate.
Verification pending: basic gates, focused Rust tests, Chromium against the actual gateway router, and independent review; this session owns the next local build.
Next: irzhywau review after green checks, merge after approval, then #169; design #172 waits for both merges.
andersalm commentedon Oct 1, 2026
In progress: #168 response sandbox is implemented on base c9205a7; PR pending.
The first focused run passed three Rust regressions: CID aliases/bytes, site/provenance, and owner/guest cookie-only API refusal; browser test is run separately.
Basic gates, Browser entropy and all 29 close-handshake tests pass; final tests also cover provider cache misses and bounded server cleanup.
Remaining: Chromium proof against the actual gateway, independent review, then CI and irzhywau approval; one local build ran and free disk remains above 15%.
Next issue is #169 after approved merge; #172 design waits for #168/#169 merges.
andersalm commentedon Oct 1, 2026
In progress: #168 candidate now also refuses opaque/cross-site Home/app API document and resource loads; base develop c9205a7, PR pending.
Independent review round 1 found that forms, frames and popups bypass connect-src; the added guard preserves app fetches and ticketed terminal streams.
Three Rust checks pass; Chromium proved the initial cookie/fetch boundary and found a fixture-only Copy issue because its command remained hidden.
Final regressions now submit a real form, load an API frame, click an API popup, verify unchanged workspace, and show the operator command before testing selection recovery.
Remaining: final Rust/Chromium run, review round 2, CI and irzhywau approval; #169 follows the approved merge.
andersalm commentedon Oct 1, 2026
QA / Review: #168 candidate 6a4b279 (tree cd4d712e3336795741f3df9d975bc6763ade661f) is ready to publish to origin/fix/168-content-sandbox; PR target develop, PR pending.
CID and user-site pages receive an opaque CSP; script API connections and opaque/cross-site API resource/navigation loads are refused while admitted app fetches retain their authority checks.
Proof passes: three focused Rust regressions, real-gateway Chromium regression, 26 site/publication tests, 29 close-handshake tests, Browser entropy and all four basic gates.
Independent review completed in two rounds and approved this candidate; CI and required irzhywau approval remain before normal merge.
Next: #169 after #168 merge; #172 design follows #168/#169; active worktree retained through review, test processes stopped and free disk above 15%.
andersalm commentedon Oct 1, 2026
QA / Review: draft PR #188 #188 targets develop with candidate 6a4b279, tree cd4d712e3336795741f3df9d975bc6763ade661f.
Published one commit to origin/fix/168-content-sandbox; local/remote divergence 0/0; the opaque content policy and API resource/navigation guard are ready for review.
Proof passes: three focused Rust tests, real-gateway Chromium, 26 site/publication tests, 29 close-handshake tests, Browser entropy and all four basic gates; independent review round 2 approves.
CI is pending; request irzhywau when checks are green, then merge normally after his approval and current-base compatibility; installed/public deployment stays with its owning issues.
Next: #169 after merge, then #167/#170; #172 design waits for #168/#169. Test processes stopped, active worktree retained through #168 review, free disk above 15%.
andersalm commentedon Oct 1, 2026
CI run 36924328983 passed workspace tests, then stalled after the Chromium download reached 100%.
The added fixture used Playwright 1.59.1 with Node 26, matching upstream extraction defect #40724.
Candidate
acfe57f1uses the fixed Playwright 1.60.0, headless shell only, installer diagnostics and a five-minute install limit.A fresh Node 26 install and
content_sandbox_browser --ignored --nocapturepass locally; formatting and entropy gates pass.PR #188 stays in QA while CI checks the candidate; green checks will trigger the Irzhy review request.
andersalm commentedon Oct 1, 2026
Candidate
acfe57f14b0c6b066d556d6bbde628e907de39dcpassed test-elastos in run 36932494769.The browser fixture installation completed, and the actual gateway content_sandbox_browser regression passed.
The Playwright 1.60.0 extraction fix resolves the Node 26 hang introduced by the earlier fixture pin.
Source, lint, capsule, custody and Linux ARM checks pass; the other source-home checks are still active.
PR #188 remains draft until all checks are green, then this session will request irzhywau.
andersalm commentedon Oct 1, 2026
Candidate
acfe57f14b0c6b066d556d6bbde628e907de39dchas eight passing CI checks in run 36932494769.The Node 26 ZIP extraction hang is fixed by Playwright 1.60.0; fixture installation and the actual content_sandbox_browser test both pass.
PR #188 is ready for review, and irzhywau is requested on GitHub.
Local and origin task branch divergence is 0/0; the two independent source review rounds are complete.
#168 stays in QA until Irzhy approves and the PR merges into develop; #169 is draft PR195 and #167 is in source validation.
andersalm commentedon Oct 2, 2026
Candidate acfe57f retains eight passing checks in run 36932494769.
PR #188 is ready, with irzhywau already requested and his approval still open.
The task worktree is clean and matches origin with divergence 0/0; current develop is 356839f after its CI-only #196 merge.
A read-only three-way compatibility check combines this candidate with current develop cleanly; its content sandbox proof remains current.
#168 stays in QA until approval and merge; #169 and #167 are completing their current proof, with the #172 design note after #168/#169 integration.
andersalm commentedon Oct 2, 2026
PR #188 merged into develop as
b0d3f8927e13b163b4fdb8349d4fa78ac09af1f1; candidateacfe57f14b0c6b066d556d6bbde628e907de39dc.CI 36932494769 passes all eight checks, including actual-browser CID/site refusal and the copied operator website.
All nine content/site routes apply the opaque sandbox CSP; cookie reads and unauthorized Home/app calls fail in the regression.
Operator-run Claude Opus adversarial review records PASS; the remaining boundary note belongs to #177.
Both Done means are proven; #168 closes, and #197 is the next merge.