469a2ef18467
fix Firefox Docker gate probe and remove invalid relay self-observation
- time
- 2026-09-04 12:15 UTC · 1 month ago
- machine
- koh2
- agent
- claude-sonnet-5
- session
- add Firefox security-sentinel coverage
- parent
- c10663875c60
↓ peach-browser-469a2ef1.tar.gzatlas at this save
files changed2 files
Dockerfile.firefox-gate+10 −0scripts/test-firefox-passkeys.mjs+1 −23Dockerfile.firefox-gate+10 −0
@@ -0,0 +1,10 @@1+FROM oven/bun:1.3.14-debian2+3+RUN apt-get update \4+ && apt-get install -y --no-install-recommends firefox-esr ca-certificates nodejs npm5+6+WORKDIR /app7+ENV FIREFOX_BIN=/usr/bin/firefox-esr8+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright9+10+RUN bunx playwright install --with-deps firefoxscripts/test-firefox-passkeys.mjs+1 −23
@@ -128,23 +128,7 @@128128 const createIsNative = createStr.includes("[native code]");129129 const getIsNative = getStr.includes("[native code]");130130 131- // 2. Check no PEACH_PASSKEY_RESPONSE postMessage listener exists.132- // Dispatch a forged response and verify no handler picks it up.133- let forgedResponseReceived = false;134- const forgedListener = (event) => {135- if (event.data?.type === "PEACH_PASSKEY_RESPONSE") {136- forgedResponseReceived = true;137- }138- };139- window.addEventListener("message", forgedListener);140- window.postMessage(141- { type: "PEACH_PASSKEY_RESPONSE", id: "forged-uuid-test", payload: { ok: true } },142- window.location.origin,143- );144- await new Promise((r) => setTimeout(r, 200));145- window.removeEventListener("message", forgedListener);146-147- // 3. Verify no PEACH_PASSKEY_REQUEST postMessage is used by the bridge.131+ // 2. Verify no PEACH_PASSKEY_REQUEST postMessage is used by the bridge.148132 // We check the page for any existing listeners that post PEACH_PASSKEY_REQUEST.149133 const pageSourceHasRelay = document.documentElement.innerHTML.includes("PEACH_PASSKEY_REQUEST");150134 @@ -185,7 +169,6 @@185169 pageOrigin: location.origin,186170 createIsNative,187171 getIsNative,188- forgedResponseReceived,189172 pageSourceHasRelay,190173 createResult,191174 createError,@@ -271,11 +254,6 @@271254 // 2. navigator.credentials.get must be wrapped (not native).272255 if (result.getIsNative) {273256 failures.push("navigator.credentials.get is not wrapped by exportFunction — the privileged bridge was not installed");274- }275-276- // 3. No forgeable PEACH_PASSKEY_RESPONSE channel.277- if (result.forgedResponseReceived) {278- failures.push("a PEACH_PASSKEY_RESPONSE postMessage listener exists — the forgeable relay was not removed");279257 }280258 281259 // 4. No PEACH_PASSKEY_REQUEST in page source.