From eb20a5b7780fe624c78e6f222ffdbb1456e721aa Mon Sep 17 00:00:00 2001 From: Local Dev Date: Tue, 6 Oct 2026 22:34:25 +0200 Subject: [PATCH] fix(theseus,gateway): don't leak relay chrome into BNS-aware clients MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Diagnosis: Theseus does not actually redirect to navigate.st — but for `s3`-record names, it fetches content THROUGH /bns// on the gateway (Sia keys cannot ship in a public build). Since 0.3.80 that fetch carries `x-bns-policy: client` so the gateway suppresses the relay banner + chip; older Theseus releases got the chrome bleed- through, which read as "redirected to navigate.st" even though the address bar still showed https://. Two-layer defense: Gateway: Each injected block is now wrapped in `` / `` sentinel comments so any downstream client can strip it surgically without parsing the nested markup. Function is unchanged for browsers (chrome shown by default; suppressed on x-bns-policy: client). Theseus main.js serveBns() s3 branch: Already stripped the injected `` tag. Now also strips any relay banner / chip / boot script found between the sentinel comments. Catches older gateways, misconfigured deploys, or any future edge cache that returns a chrome-bearing response. No change to h / ip / p / u paths — those don't touch the gateway. Other BNS-aware clients (Ariadne daemon, Ariadne mobile) that also proxy s3 through the gateway should apply the same sentinel-based stripping or send x-bns-policy: client. The gateway honours either. --- src/gateway/public-gateway.mjs | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs index 6f74112..aa63bcd 100644 --- a/src/gateway/public-gateway.mjs +++ b/src/gateway/public-gateway.mjs @@ -547,7 +547,7 @@ function injectRelayChrome(html, name, reqPath, subBase, opts) { // Persistent chip — shown on both forms. On the subdomain form it's the // only trust indicator; on the path form it stays after the banner is // dismissed so the user still knows they're on a relay. - const chip = `
+ const chip = `
`; +`; // Full banner — path form only. - const banner = pathForm ? `
+ const banner = pathForm ? `
⚠ Relayed site ${esc(name)} is being served through navigate.st. Scripts here run under the gateway's origin — do not sign in or paste a recovery phrase. @@ -570,9 +570,9 @@ ${pathForm ? `Stay here Install Theseus -
` : ""; +
` : ""; - const script = ``; +})();`; const combined = banner + chip + script; // Insert just after if present, otherwise at the start of the document.