Skip to content

test(desktop): isolate expected TLS error navigation - #112

Merged
phucnguyen1707 merged 2 commits into
mainfrom
test/windows-pit-tls-isolation
Sep 23, 2026
Merged

phucnguyen1707 merged 2 commits into
mainfrom
test/windows-pit-tls-isolation

Conversation

@phucnguyen1707

Copy link
Copy Markdown
Contributor

Summary

Isolate intentionally invalid HTTPS navigations in their own tabs in the same
real Windows browser context. Chromium can finish committing its internal error
page after Playwright's goto() has already rejected; reusing that tab races
the next ordinary navigation.

Observed on the post-merge run:
https://github.com/profullstack/tronbrowser.dev/actions/runs/35831711300/attempts/1

The failing step was ordinary example.com navigation interrupted by
chrome-error://chromewebdata/ after the self-signed negative test. Positive
registry HTTPS, CA import, and exact-root cleanup passed. Final PR #111 CI
had passed the complete same suite before merge.

Safety and Scope

  • Negative assertions still require ERR_CERT_AUTHORITY_INVALID specifically.
  • Tabs share the same context, trust store, extension, and proxy configuration.
  • No retries hiding failures, ignored TLS errors, or product/runtime changes.
  • No new release needed: this changes only the CI driver, not v3.14.1 assets.
  • CI runs the real browser acceptance and native helper regression matrix again.

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

56 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 33 | LOW: 20

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
HIGH sh-remote-script-execution apps/web/public/install.sh:754
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:156
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:479
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:161
MEDIUM sh-remote-script-execution apps/web/public/install.sh:166
MEDIUM sh-remote-script-execution apps/web/public/install.sh:279
MEDIUM sh-remote-script-execution apps/web/public/install.sh:297
MEDIUM sh-remote-script-execution apps/web/public/install.sh:810
MEDIUM sh-remote-script-execution apps/web/public/install.sh:861
MEDIUM sh-remote-script-execution apps/web/public/install.sh:1150
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:80
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:92
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:103
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:65
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:70
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:35
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:47
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:70
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:89
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170

…and 6 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@phucnguyen1707
phucnguyen1707 merged commit eb62524 into main Sep 23, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant