From 08e95439cf8c9ffc2f848bfa3e9f5c93b890291c Mon Sep 17 00:00:00 2001 From: dsad Date: Wed, 1 Jul 2026 02:34:54 +0300 Subject: [PATCH 1/2] fix(browser): block private-page interactions after eval navigation --- .../test_browser_private_page_action_guard.py | 59 +++++++++++++++++++ tools/browser_tool.py | 26 ++++++++ 2 files changed, 85 insertions(+) create mode 100644 tests/tools/test_browser_private_page_action_guard.py diff --git a/tests/tools/test_browser_private_page_action_guard.py b/tests/tools/test_browser_private_page_action_guard.py new file mode 100644 index 000000000000..1070731aab58 --- /dev/null +++ b/tests/tools/test_browser_private_page_action_guard.py @@ -0,0 +1,59 @@ +"""Regression tests for private-page browser interaction guards.""" + +import json + +import pytest + +from tools import browser_tool + + +PRIVATE_URL = "http://169.254.169.254/latest/meta-data/" + + +@pytest.fixture(autouse=True) +def _browser_mode(monkeypatch): + monkeypatch.setattr(browser_tool, "_is_camofox_mode", lambda: False) + monkeypatch.setattr(browser_tool, "_last_session_key", lambda task_id: task_id) + + +@pytest.mark.parametrize( + ("tool_call", "args"), + [ + (browser_tool.browser_click, ("@e1",)), + (browser_tool.browser_type, ("@e1", "do-not-send-this")), + (browser_tool.browser_press, ("Enter",)), + ], +) +def test_private_page_blocks_state_changing_actions(monkeypatch, tool_call, args): + monkeypatch.setattr(browser_tool, "_eval_ssrf_guard_active", lambda task_id: True) + monkeypatch.setattr(browser_tool, "_current_page_private_url", lambda task_id: PRIVATE_URL) + + def fail_run(*_args, **_kwargs): + raise AssertionError("browser command should not run on a private page") + + monkeypatch.setattr(browser_tool, "_run_browser_command", fail_run) + + out = json.loads(tool_call(*args, task_id="task-1")) + + assert out["success"] is False + assert PRIVATE_URL in out["error"] + assert "private or internal address" in out["error"] + assert "do-not-send-this" not in json.dumps(out) + + +def test_click_still_runs_when_current_page_is_public(monkeypatch): + calls = [] + + monkeypatch.setattr(browser_tool, "_eval_ssrf_guard_active", lambda task_id: True) + monkeypatch.setattr(browser_tool, "_current_page_private_url", lambda task_id: None) + + def fake_run(task_id, command, args): + calls.append((task_id, command, args)) + return {"success": True} + + monkeypatch.setattr(browser_tool, "_run_browser_command", fake_run) + + out = json.loads(browser_tool.browser_click("e1", task_id="task-1")) + + assert out == {"success": True, "clicked": "@e1"} + assert calls == [("task-1", "click", ["@e1"])] diff --git a/tools/browser_tool.py b/tools/browser_tool.py index ec587cc16978..5482d6df9177 100644 --- a/tools/browser_tool.py +++ b/tools/browser_tool.py @@ -2953,6 +2953,9 @@ def browser_click(ref: str, task_id: Optional[str] = None) -> str: return camofox_click(ref, task_id) effective_task_id = _last_session_key(task_id or "default") + blocked = _blocked_private_page_action(effective_task_id, "click") + if blocked is not None: + return blocked # Ensure ref starts with @ if not ref.startswith("@"): @@ -2991,6 +2994,9 @@ def browser_type(ref: str, text: str, task_id: Optional[str] = None) -> str: return camofox_type(ref, text, task_id) effective_task_id = _last_session_key(task_id or "default") + blocked = _blocked_private_page_action(effective_task_id, "type") + if blocked is not None: + return blocked # Ensure ref starts with @ if not ref.startswith("@"): @@ -3126,6 +3132,9 @@ def browser_press(key: str, task_id: Optional[str] = None) -> str: return camofox_press(key, task_id) effective_task_id = _last_session_key(task_id or "default") + blocked = _blocked_private_page_action(effective_task_id, "press") + if blocked is not None: + return blocked result = _run_browser_command(effective_task_id, "press", [key]) if result.get("success"): @@ -3145,6 +3154,23 @@ def browser_press(key: str, task_id: Optional[str] = None) -> str: +def _blocked_private_page_action(effective_task_id: str, action: str) -> Optional[str]: + """Return a blocked payload when an unsafe cloud page would receive input.""" + if not _eval_ssrf_guard_active(effective_task_id): + return None + blocked_url = _current_page_private_url(effective_task_id) + if not blocked_url: + return None + return json.dumps({ + "success": False, + "error": ( + "Blocked: page URL targets a private or internal address " + f"({blocked_url}). Refusing to {action} on this page in this " + "browser mode." + ), + }, ensure_ascii=False) + + def browser_console(clear: bool = False, expression: Optional[str] = None, task_id: Optional[str] = None) -> str: """Get browser console messages and JavaScript errors, or evaluate JS in the page. From c5f4f6128bd2c77388fcfdbdbc00a06d065fdbda Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Wed, 1 Jul 2026 13:46:06 +0530 Subject: [PATCH 2/2] test(browser): cover guard-inactive + camofox short-circuit paths; fix blank lines Review follow-up on the private-page action guard: - Add test_guard_inactive_does_not_block_or_probe: when the SSRF guard is inactive (local backend / allow_private_urls), click/type/press must proceed WITHOUT probing the page URL. This is the branch most likely to silently regress if the guard condition is inverted; a mutation check (flipping the condition) confirms the test fails as designed. - Add test_camofox_short_circuits_before_guard: camofox mode returns from the dedicated camofox_* path before the guard runs; guards never consulted. - Fix PEP8: 3 -> 2 blank lines before _blocked_private_page_action. --- .../test_browser_private_page_action_guard.py | 47 +++++++++++++++++++ tools/browser_tool.py | 3 -- 2 files changed, 47 insertions(+), 3 deletions(-) diff --git a/tests/tools/test_browser_private_page_action_guard.py b/tests/tools/test_browser_private_page_action_guard.py index 1070731aab58..f0d906e62611 100644 --- a/tests/tools/test_browser_private_page_action_guard.py +++ b/tests/tools/test_browser_private_page_action_guard.py @@ -57,3 +57,50 @@ def fake_run(task_id, command, args): assert out == {"success": True, "clicked": "@e1"} assert calls == [("task-1", "click", ["@e1"])] + + +def test_guard_inactive_does_not_block_or_probe(monkeypatch): + """When the SSRF guard is inactive (local backend / allow_private_urls), + the action must proceed WITHOUT even probing the page URL — a private-looking + current URL is irrelevant. This is the branch most likely to silently regress + if the guard condition is ever inverted, so it is exercised explicitly.""" + calls = [] + + monkeypatch.setattr(browser_tool, "_eval_ssrf_guard_active", lambda task_id: False) + + def fail_probe(task_id): + raise AssertionError("_current_page_private_url must not be probed when guard inactive") + + monkeypatch.setattr(browser_tool, "_current_page_private_url", fail_probe) + + def fake_run(task_id, command, args): + calls.append((task_id, command, args)) + return {"success": True} + + monkeypatch.setattr(browser_tool, "_run_browser_command", fake_run) + + out = json.loads(browser_tool.browser_click("@e1", task_id="task-1")) + + assert out == {"success": True, "clicked": "@e1"} + assert calls == [("task-1", "click", ["@e1"])] + + +def test_camofox_short_circuits_before_guard(monkeypatch): + """Camofox mode returns from the dedicated camofox_* path BEFORE reaching the + private-page guard, so the guard's helpers must never be consulted. Guards the + ordering invariant (camofox early-return precedes _last_session_key + guard).""" + monkeypatch.setattr(browser_tool, "_is_camofox_mode", lambda: True) + + def fail_guard(task_id): + raise AssertionError("guard must not run in camofox mode") + + monkeypatch.setattr(browser_tool, "_eval_ssrf_guard_active", fail_guard) + monkeypatch.setattr(browser_tool, "_current_page_private_url", fail_guard) + + import tools.browser_camofox as camofox + + monkeypatch.setattr(camofox, "camofox_click", lambda ref, task_id: '{"success": true, "camofox": true}') + + out = json.loads(browser_tool.browser_click("@e1", task_id="task-1")) + + assert out == {"success": True, "camofox": True} diff --git a/tools/browser_tool.py b/tools/browser_tool.py index 5482d6df9177..64c29d72e4ee 100644 --- a/tools/browser_tool.py +++ b/tools/browser_tool.py @@ -3151,9 +3151,6 @@ def browser_press(key: str, task_id: Optional[str] = None) -> str: return json.dumps(_copy_fallback_warning(response, result), ensure_ascii=False) - - - def _blocked_private_page_action(effective_task_id: str, action: str) -> Optional[str]: """Return a blocked payload when an unsafe cloud page would receive input.""" if not _eval_ssrf_guard_active(effective_task_id):