silentmode/argus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(theseus,gateway): don't leak relay chrome into BNS-aware clients

Browse source 
Diagnosis: Theseus does not actually redirect to navigate.st — but for
`s3`-record names, it fetches content THROUGH /bns/<name>/ on the
gateway (Sia keys cannot ship in a public build). Since 0.3.80 that
fetch carries `x-bns-policy: client` so the gateway suppresses the
relay banner + chip; older Theseus releases got the chrome bleed-
through, which read as "redirected to navigate.st" even though the
address bar still showed https://<name>.

Two-layer defense:

Gateway:
  Each injected block is now wrapped in `<!--nav-relay-X-start-->` /
  `<!--nav-relay-X-end-->` sentinel comments so any downstream client
  can strip it surgically without parsing the nested markup. Function
  is unchanged for browsers (chrome shown by default; suppressed on
  x-bns-policy: client).

Theseus main.js serveBns() s3 branch:
  Already stripped the injected `<base href="/bns/...">` tag. Now also
  strips any relay banner / chip / boot script found between the
  sentinel comments. Catches older gateways, misconfigured deploys,
  or any future edge cache that returns a chrome-bearing response.
  No change to h / ip / p / u paths — those don't touch the gateway.

Other BNS-aware clients (Ariadne daemon, Ariadne mobile) that also
proxy s3 through the gateway should apply the same sentinel-based
stripping or send x-bns-policy: client. The gateway honours either.
This commit is contained in:
Local Dev 2026-10-06 22:34:25 +02:00
parent 32d514ecc4
commit eb20a5b778
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/gateway/public-gateway.mjs
View file

@ -547,7 +547,7 @@ function injectRelayChrome(html, name, reqPath, subBase, opts) {
// Persistent chip — shown on both forms. On the subdomain form it's the
// only trust indicator; on the path form it stays after the banner is
// dismissed so the user still knows they're on a relay.
const chip = `<div id="__nav_relay_chip" style="all:initial;position:fixed;bottom:12px;right:12px;z-index:2147483646;font:12.5px/1.3 system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
const chip = `<!--nav-relay-chip-start--><div id="__nav_relay_chip" style="all:initial;position:fixed;bottom:12px;right:12px;z-index:2147483646;font:12.5px/1.3 system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
<button type="button" id="__nav_relay_chip_btn" aria-expanded="false" aria-controls="__nav_relay_chip_pop" style="all:initial;display:inline-flex;align-items:center;gap:7px;background:rgba(26,32,48,.92);color:#e7eaf1;padding:7px 12px;border-radius:999px;border:1px solid rgba(214,255,61,.25);cursor:pointer;font:inherit;backdrop-filter:blur(8px);box-shadow:0 2px 10px rgba(0,0,0,.28)">
<span style="all:initial;color:#d6ff3d;font:inherit">📡</span>
<span style="all:initial;color:#fff;font:inherit;font-weight:600">${esc(name)}</span>
@ -558,10 +558,10 @@ function injectRelayChrome(html, name, reqPath, subBase, opts) {
<div style="all:initial;display:block;color:#e7eaf1;margin-bottom:10px;font:inherit"><b style="all:initial;color:#fff;font-weight:600;font:inherit">${esc(name)}</b> is being served through <b style="all:initial;color:#fff;font-weight:600;font:inherit">navigate.st</b>. ${pathForm ? "Scripts here run under the gateway's origin — do not sign in or paste a recovery phrase." : "Each name has its own origin here. Scripts can't reach other BCDN sites."}</div>
${pathForm ? `<a href="${esc(subUrl)}" style="all:initial;display:inline-block;background:#d6ff3d;color:#0b0e14;padding:6px 12px;border-radius:999px;text-decoration:none;font-weight:600;margin-right:8px;font:12px/1 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;cursor:pointer">Isolated view ↗</a>` : ""}
<a href="https://silentmode.st/theseus" style="all:initial;color:#a9b8d0;text-decoration:underline;cursor:pointer;font:12px/1 system-ui,-apple-system,Segoe UI,Roboto,sans-serif">Install Theseus for trustless resolution</a>
</div></div>`;
</div></div><!--nav-relay-chip-end-->`;
// Full banner — path form only.
const banner = pathForm ? `<div id="__nav_relay_banner" style="all:initial;display:block;position:fixed;top:0;left:0;right:0;z-index:2147483647;font:14px/1.4 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;background:#1a2030;color:#e7eaf1;border-bottom:2px solid #d6ff3d;padding:10px 14px;box-shadow:0 2px 10px rgba(0,0,0,.3);box-sizing:border-box">
const banner = pathForm ? `<!--nav-relay-banner-start--><div id="__nav_relay_banner" style="all:initial;display:block;position:fixed;top:0;left:0;right:0;z-index:2147483647;font:14px/1.4 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;background:#1a2030;color:#e7eaf1;border-bottom:2px solid #d6ff3d;padding:10px 14px;box-shadow:0 2px 10px rgba(0,0,0,.3);box-sizing:border-box">
<div style="all:initial;display:flex;max-width:1200px;margin:0 auto;align-items:center;gap:14px;flex-wrap:wrap;color:inherit;font:inherit">
<span style="all:initial;color:#d6ff3d;font-weight:600;font:inherit">⚠ Relayed site</span>
<span style="all:initial;color:#e7eaf1;flex:1;min-width:220px;font:inherit"><b style="all:initial;color:#fff;font:inherit;font-weight:600">${esc(name)}</b> is being served through <b style="all:initial;color:#fff;font:inherit;font-weight:600">navigate.st</b>. Scripts here run under the gateway's origin — do not sign in or paste a recovery phrase.</span>
@ -570,9 +570,9 @@ ${pathForm ? `<a href="${esc(subUrl)}" style="all:initial;display:inline-block;b
<button type="button" id="__nav_relay_stay" style="all:initial;color:#a9b8d0;text-decoration:underline;cursor:pointer;background:transparent;border:none;font:14px/1 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;padding:0">Stay here</button>
<a href="https://silentmode.st/theseus" style="all:initial;color:#a9b8d0;text-decoration:underline;cursor:pointer;font:14px/1 system-ui,-apple-system,Segoe UI,Roboto,sans-serif">Install Theseus</a>
<button type="button" id="__nav_relay_dismiss" aria-label="Dismiss" style="all:initial;color:#8b98a9;cursor:pointer;padding:4px 8px;font:14px/1 system-ui;background:transparent;border:none">✕</button>
</div></div>` : "";
</div></div><!--nav-relay-banner-end-->` : "";
const script = `<script>(function(){
const script = `<!--nav-relay-script-start--><script>(function(){
var SUB = ${JSON.stringify(subUrl)};
var PATH_FORM = ${pathForm ? "true" : "false"};
var COUNTDOWN_SECONDS = 10;
@ -665,7 +665,7 @@ ${pathForm ? `<a href="${esc(subUrl)}" style="all:initial;display:inline-block;b
if (document.readyState !== "loading") { repad(); startCountdown(); }
else document.addEventListener("DOMContentLoaded", function() { repad(); startCountdown(); });
window.addEventListener("resize", repad);
})();</script>`;
})();</script><!--nav-relay-script-end-->`;
const combined = banner + chip + script;
// Insert just after <body> if present, otherwise at the start of the document.