[cliffhall]

Closes #2872

Fix for GHSA-h9j8-vj8g-v3gg, developed and reviewed in the advisory's private fork (inspector-GHSA-h9j8-vj8g-v3gg#1) and landed here as an ordinary PR. The commits are the fork branch's, unchanged.

An MCP App rendered on the opaque-origin (srcdoc) path could navigate its own sandbox frame to another origin. Nothing stopped it:

• Sandbox flags only govern other browsing contexts.
• No CSP directive governs a frame navigating itself.

The navigated page kept origin "null" and the same contentWindow, so the proxy kept treating it as the app:

• the navigation URL carried data out despite connect-src 'none'
• host messages (tool results) were relayed to it with "*"
• its JSON-RPC was relayed to the host

Changes

1. Frame policy on the proxy document, built per render (clients/web/static/sandbox_proxy.html). frame-src and child-src allow the approved frameDomains on the srcdoc path, the dedicated app origin on the _meta.ui.domain path, and 'none' otherwise.
   • It is inserted as a <meta> CSP, because the app's CSP grant is only known after the proxy page loads.
   • The response header stays frame-ancestors-only, per sandbox-controller.ts: a static header would break approved frameDomains, since srcdoc inherits it.
   • The host now passes the approved grant in the spec's csp slot of sandbox-resource-ready (createAppBridgeFactory.ts). The proxy reads only frameDomains and re-screens it.
2. Navigation detection.
   • On the srcdoc path, a second load, or a securitypolicyviolation from the proxy's own frame policy, closes the relay in both directions.
   • It also removes the frame and posts a notifications/message (level error) to the host.
   • The violation trigger covers Firefox, which blocks the navigation without firing a second load.
3. The false comment is corrected. It claimed "*" was safe because a srcdoc frame cannot navigate elsewhere.

Tests

• createAppBridgeFactory.test.ts: only approved frameDomains reach the proxy.

• New engine smoke npm run smoke:web:sandbox (scripts/smoke-web-sandbox-navigation.mjs), against the real prod-served proxy. It checks three cases:

  • a well-behaved app works
  • a navigation to an undeclared origin produces zero requests to the attacker and no relayed tools/call, and the error is reported
  • a navigation to a declared frame domain is caught and the frame removed

  It fails on the old proxy (the frame reached an undeclared origin: /attack?leak=x). It is in ENGINE_SMOKES: Chromium in CI, Firefox in the gate.

• Manual harness, Chromium 156 and Firefox, before and after: the leak and the bridge takeover reproduce on v2/main and are blocked with this change. Nested approved frames and dedicated-origin apps still work.

• npm run local:gate: green, including smoke:web:sandbox under both engines and Storybook 123/123.

Known residual

Navigating to a domain the app declared in frameDomains passes the policy. A fixed script in the host wrapper runs before the app's code and tells the proxy when the frame starts to leave, on beforeunload and pagehide. The proxy then closes the relay and removes the frame. It does this even when the app navigates before its own document has finished loading, with a second-load check as a backup. In practice the frame is gone before the destination's first request is sent. A relayed tools/call in that window is now unlikely, but no browser guarantee rules it out. That is still within the grant: a declared frame domain is already an egress channel, and the app could send that call itself. Closing it fully needs a MessagePort transport, which requires SDK and spec changes and is out of scope.

Lines

v2 only. v1's proxy checks the inner frame's real origin, so a navigated page's messages are rejected there.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

An approved-domain navigation can retain the relay indefinitely when it produces the first load event, and the smoke test does not verify that declared-domain navigation actually succeeds.

2 open issues

• Close the relay when allowed navigation finishes the first load · New
• Assert approved-domain navigation reaches the load watcher · New

What changed in this PR

This PR addresses #2872 by restricting MCP App sandbox navigation in the web client and closing message relays when navigation is detected.

Changes:

• Adds per-render frame policies using approved CSP grants, plus frame removal and host error reporting on detected navigation.
• Adds a sandbox-navigation browser smoke to the Chromium and Firefox engine suites.
• Updates bridge tests, smoke registration, and quality-gate documentation.

File	Description
scripts/​smoke-web-sandbox-navigation.mjs	Adds normal, blocked-navigation, and declared-domain smoke cases.
scripts/​run-engine-smokes.test.mjs	Updates assertions for sandbox smoke registration.
scripts/​run-engine-smokes.mjs	Includes the sandbox smoke in engine runs.
scripts/​lib/​headless-browser.mjs	Updates comments to include the new smoke.
package.json	Adds the smoke:web:sandbox command.
docs/​quality-gate.md	Documents sandbox coverage, engine runs, and ports.
clients/​web/​static/​sandbox_proxy.html	Adds frame policies, navigation detection, and relay shutdown.
clients/​web/​src/​components/​elements/​AppRenderer/​createAppBridgeFactory.ts	Passes approved CSP grants to the proxy.
clients/​web/​src/​components/​elements/​AppRenderer/​createAppBridgeFactory.test.ts	Verifies that only approved frame domains reach the proxy.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1 (review 5775535843): two findings, fixed in 3859e09 and answered in each thread.

1. Navigating while the original load is pending.
   • Fix: a fixed script in the host wrapper (wrapSandboxedHtml) runs before the app's code and tells the proxy when the frame starts to leave. On the srcdoc path the proxy then closes the relay and removes the frame. The second-load check stays as a backup.
   • Events: pagehide alone isn't enough, because Chromium doesn't fire it when the navigation cuts the load short, so the script also listens for beforeunload.
   • New smoke case 4: a nested frame that never finishes loading holds the app's load open, then the app navigates to a declared domain. On the old proxy it timed out in Chromium. It now passes in Chromium and Firefox.
2. Proving the declared navigation was allowed. The proxy now usually removes the frame before the /declared request is sent, so that request can't serve as proof. Cases 3 and 4 now first open a nested frame on the declared domain, and fail unless the listener served it. As a mutation check, I forced the proxy's frame policy to 'none', and case 3 failed.

local:gate passed (exit 0): web 9,601 tests across 474 files, Storybook 123/123, and smoke:web:sandbox OK in both engines. I updated the PR body's "Known residual" section to match.

[Copilot]

🟡 Changes recommended

A critical navigation-detection bypass allows document.open() to remove departure listeners during a pending load, leaving the proxy relay open after navigation to an approved frame domain.

1 open issue

• document.open() removes departure listeners, leaving the relay open · New

2 resolved since last review

• Close the relay when allowed navigation finishes the first load
• Assert approved-domain navigation reaches the load watcher

_{Review effort: Balanced}

[cliffhall]

Copilot round 2 (review 5776227654): one finding, declined in its thread as outside #2872. A document.open() that strips the departure listeners can only keep the relay for a navigation to a domain the app declared. Such a page can do nothing the app couldn't already do, and undeclared origins are still refused by the frame policy. This is the documented "Known residual". No code change, so the review loop stops here.

[Copilot]

🔵 Needs a closer look

This browser-enforced security-boundary change needs independent Chromium/Firefox validation of CSP inheritance and navigation ordering, plus security-maintainer confirmation of the accepted declared-domain relay residual, because browser execution and private advisory review were unavailable.

No open issues 🎉

1 resolved since last review

• document.open() removes departure listeners, leaving the relay open

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the proxy can block approved URLs containing apostrophes, while early frame teardown can let the navigation smoke test pass without proving CSP enforcement.

No open issues 🎉

_{Review effort: Balanced}