trace_b7a41153f1e34063a43dd4c431f7eabd

This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start from apps/ios/Sources/Screen/ScreenWebView.swift and trace how A2UI message-origin checks decide whether a page may invoke bridge actions, then follow ScreenController and NodeAppModel navigation paths to determine whether generic local-network pages can reach agent.request dispatch without the stricter trusted-canvas URL check.

{
  "executiveSummary": "Analysis identified a vulnerability in iOS A2UI bridge origin validation. The ScreenWebView.swift WKScriptMessage handler uses different trust checks for file vs non-file URLs. For non-file URLs, it relies on `isLocalNetworkCanvasURL()` which is more permissive than the strict `isTrustedCanvasUIURL()` check used for file URLs. This allows any local-network or tailnet page to invoke A2UI bridge actions without requiring the bundled scaffold or exact capability-backed A2UI URL.",
  "reports": [
    {
      "title": "iOS A2UI Bridge Origin Validation Bypass via Local-Network Pages",
      "severity": "HIGH",
      "summary": "iOS A2UI bridge accepts messages from any local-network page instead of requiring strict trusted-canvas URL validation",
      "rootCauseAnalysis": "The CanvasA2UIActionMessageHandler has asymmetric trust validation: file URLs require the strict isTrustedCanvasUIURL check (which only allows the bundled scaffold), but non-file URLs only require isLocalNetworkCanvasURL which accepts any local-network HTTP URL. This allows generic local-network pages to retain bridge authority they should not have.",
      "impact": "Generic local-network or tailnet pages can invoke privileged A2UI bridge actions that should be restricted to the bundled scaffold or exact capability-backed A2UI URLs. This bypasses the trust model and allows untrusted pages to dispatch agent requests.",
      "attackPath": "An attacker can host a malicious page on any local-network or tailnet address. When this page is loaded in the screen webview, the WKScriptMessage handler in CanvasA2UIActionMessageHandler accepts messages from non-file URLs based on the permissive isLocalNetworkCanvasURL() check. This allows the untrusted page to reach agent.request dispatch without the stricter trusted-canvas URL check that should be required.",
      "stepsToReproduce": [
        "Host a malicious HTML page on any local-network or tailnet HTTP server",
        "Load that page URL in the screen webview",
        "Send an A2UI action message via the window.webkit.messageHandlers.openclawCanvasA2UIAction.postMessage API",
        "Observe that the message is accepted and dispatched to agent.request despite the page not being the trusted bundled scaffold or exact A2UI URL"
      ],
      "vulnerableFiles": [
        "apps/ios/Sources/Screen/ScreenWebView.swift",
        "apps/ios/Sources/Screen/ScreenController.swift"
      ],
      "evidence": [
        "ScreenWebView.swift lines 135-146: The userContentController method shows different checks for file vs non-file URLs",
        "ScreenWebView.swift: 'if url.isFileURL { guard controller.isTrustedCanvasUIURL(url) } else { guard controller.isLocalNetworkCanvasURL(url) }'",
        "ScreenController.swift lines 263-265: isLocalNetworkCanvasURL delegates to LocalNetworkURLSupport.isLocalNetworkHTTPURL",
        "ScreenController.swift lines 245-254: isTrustedCanvasUIURL only allows the exact bundled canvasSca