The store listing must not be a photograph of your machine - #70
Merged
Merged
Conversation
Taking the screenshots for the Chrome Web Store listing put six of souta's hosts on screen: panza souta@<address>:<port> rosina <user>@<address>:<port>, via Panza yukawa-mercury <user>@mercury.<site> yukawa-sushiki <user>@Sushiki, via yukawa-mercury yukawa-front <user>@front, via yukawa-mercury issp-ohtaka <user>@ohtaka.<site> The dashboard's second section lists every host ssh can reach, with what `ssh -G` resolves for each, and the first names the account and path a site is rooted at. Those images exist to be uploaded to a public page. Nothing leaked -- `e2e/shots/` is gitignored and the files never left this machine -- but the documented procedure was "run this, attach the output", and the output is somebody's infrastructure. So the shots move to a fresh runner. `shots.yml` sets up a throwaway sshd, copies the invented ssh_config in `e2e/shots-config/` over the runner's own, and uploads the images as an artifact. Nothing in frame belongs to anyone, and the picture is the same every time, which a listing image should be anyway. `shots.mjs` refuses any host but a local one. A procedure that depends on remembering is the one that fails once. The listing text had drifted from the extension in the other direction. Its data disclosure told you to tick "Website content" and "Personal communications", describing an annotation feature that was removed -- two false statements on a compliance form. The extension has no content script and no host permission for any site, so there is no code path that could read a page; both are now declared "no" with what makes them checkable. `web_accessible_resources` arrived today and is justified for a reviewer who reads the manifest. PRIVACY.md invited a check and failed it: it said `background.ts` contains exactly one `fetch`. It contains three. All three go to 127.0.0.1, which was the point being made, but a claim offered for verification has to survive being verified. Signed-off-by: Souta <shimozono-sota631@g.ecc.u-tokyo.ac.jp>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Taking the screenshots for the Chrome Web Store listing put six real hosts on screen — the dashboard's second section lists every host
sshcan reach, with the user, address, port and jump hostssh -Gresolves for each, and the first names the account and path a site is rooted at.Nothing leaked:
e2e/shots/is gitignored and the files never left the machine. But the documented procedure inSTORE.mdand issue #45 was "runnpm --prefix e2e run shots, attach the output", and the output is somebody's infrastructure, destined for a public page.The fix
shots.yml(manual dispatch) runs the shots on a fresh runner: throwaway sshd,e2e/treeas the site, and the inventedssh_configine2e/shots-config/copied over the runner's own. Nothing in frame belongs to anyone, and the picture is identical every run — which a listing image should be anyway.shots.mjsrefuses any host but a local one, because a procedure that depends on remembering is the one that fails once:The listing had drifted the other way too
The data disclosure declared two things the extension does not do. It told you to tick Website content ("the text of pages … read in order to find the words a note was attached to") and Personal communications ("the notes the user types") — an annotation feature that was removed. Those are false statements on a compliance form. The extension has no content script and no host permission for any site, so there is no code path that could read a page; both are now "no", with what makes them checkable.
web_accessible_resourcesarrived today and is justified for a reviewer who reads the manifest.PRIVACY.md invited a check and failed it. It said
background.tscontains exactly onefetch. It contains three — control API, proxy script, token on first connect. All three go to127.0.0.1, which was the point, but a claim offered for verification has to survive being verified.zizmor clean including the new workflow; the
upload-artifactSHA was verified againstrefs/tags/v4.6.2rather than recalled.