clawbot

clawbot deleted branch issue-133-bounded-xff-scan from sneak/webhooker

2026-08-12 12:19:15 +02:00

clawbot pushed to next at sneak/webhooker

2026-08-12 12:19:15 +02:00

9bfd033a29 Bound X-Forwarded-For scanning allocation to the hop cap (closes #133)

clawbot closed issue sneak/webhooker#133

2026-08-12 12:19:14 +02:00

The hop cap bounds the walk but not the Split: a 1 MB X-Forwarded-For still allocates ~8 MB per request

clawbot merged pull request sneak/webhooker#136

2026-08-12 12:19:14 +02:00

Scan the X-Forwarded-For chain without splitting it (closes #133)

clawbot commented on pull request sneak/webhooker#136

2026-08-12 12:18:26 +02:00

Scan the X-Forwarded-For chain without splitting it (closes #133)

PASS.

Differential-tested forwardedClientAddr against next's strings.Split implementation over ~7.2M inputs (multiple header lines, leading/trailing/stray commas, whitespace-only entries,…

clawbot pushed to ci-gate-acceptance-119 at sneak/webhooker

2026-08-12 12:17:50 +02:00

c35abbb6b9 Cancellation probe D: remove broken test

clawbot deleted branch harden/issue-216-verify-displayed-values from sneak/AutistMask

2026-08-12 12:15:27 +02:00

clawbot pushed to next at sneak/AutistMask

2026-08-12 12:15:27 +02:00

918e581ef3 harden: verify the signed transaction against what the popup displayed (closes #216)

clawbot merged pull request sneak/AutistMask#269

2026-08-12 12:15:26 +02:00

harden: verify the signed transaction against what the popup displayed (closes #216)

clawbot closed issue sneak/AutistMask#216

2026-08-12 12:15:26 +02:00

harden: approval verification compares against the dApp's request, not against what the popup displayed

clawbot commented on pull request sneak/AutistMask#270

2026-08-12 12:15:20 +02:00

fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)

Reworked, head ada643c, rebased onto next at a08ba6a.

Finding 1 — fixed. Strip is now /[\p{Cf}\p{Default_Ignorable_Code_Point}]/gu. Re-measured the four bypasses myself in the pinned…

clawbot pushed to test/issue-184-firefox-e2e-harness at sneak/AutistMask

2026-08-12 12:14:28 +02:00

7513e70a2c test: containerized Firefox end-to-end harness (closes #184)

a08ba6a66d fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)

09b602579a fix: one password-failure message across every screen (closes #172)

Compare 3 commits »

clawbot pushed to fix/issue-260-padded-symbol-spoof at sneak/AutistMask

2026-08-12 12:13:59 +02:00

ada643cb44 fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)

a08ba6a66d fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)

09b602579a fix: one password-failure message across every screen (closes #172)

18b47cd579 test: close the empty-batch hole in the e2e unstubbed-request guard (closes #187)

Compare 4 commits »

clawbot pushed to ci-gate-acceptance-119 at sneak/webhooker

2026-08-12 12:12:57 +02:00

0fb6c81401 Acceptance probe: deliberately broken test

clawbot pushed to harden/issue-216-verify-displayed-values at sneak/AutistMask

2026-08-12 12:11:48 +02:00

993afbc5da harden: verify the signed transaction against what the popup displayed (closes #216)

a08ba6a66d fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)

09b602579a fix: one password-failure message across every screen (closes #172)

18b47cd579 test: close the empty-batch hole in the e2e unstubbed-request guard (closes #187)

Compare 4 commits »

clawbot commented on issue sneak/prompts#40

2026-08-12 12:08:25 +02:00

All linting must run in Docker: canonicalise homoicon's Dockerfile.lint + script/lint pattern

Do not copy homoicon's script/lint / script/cibuild into another repo yet. The version that existed when this issue was last updated carries a silent false green. A corrected version is…

clawbot deleted branch fix/issue-224-filter-restored-viewstack from sneak/AutistMask

2026-08-12 12:07:51 +02:00

clawbot pushed to next at sneak/AutistMask

2026-08-12 12:07:50 +02:00

a08ba6a66d fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)

clawbot merged pull request sneak/AutistMask#266

2026-08-12 12:07:49 +02:00

fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)

clawbot closed issue sneak/AutistMask#224

2026-08-12 12:07:49 +02:00

fix: the restored viewStack can contain views the popup may not reopen onto, giving a dead-end screen