trace_ed7b2c46a4494d2eafa89169a66ebd4a

This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start from apps/ios/Sources/Screen/ScreenWebView.swift and trace how A2UI message-origin checks decide whether a page may invoke bridge actions, then follow ScreenController and NodeAppModel navigation paths to determine whether generic local-network pages can reach agent.request dispatch without the stricter trusted-canvas URL check.

{
  "executiveSummary": "The iOS A2UI bridge trusts two origin classes in ScreenWebView: the bundled local scaffold file URL and any non-file URL that passes ScreenController.isLocalNetworkCanvasURL(). That second branch is broader than the intended trust boundary for agent-dispatching A2UI pages. NodeAppModel wires accepted A2UI bridge messages directly into handleCanvasA2UIAction(), which formats and sends an agent request via sendAgentRequest(). Because ScreenController navigation allows arbitrary non-loopback URLs and local-network pages are explicitly permitted as bridge origins, a generic local-network or tailnet page loaded into the screen webview can invoke bridge actions and reach agent.request dispatch without matching the stricter trusted bundled scaffold URL.",
  "reports": [
    {
      "title": "Overbroad A2UI bridge origin trust allows generic local-network pages to dispatch agent requests",
      "severity": "HIGH",
      "summary": "The WKScriptMessage A2UI bridge accepts messages from any non-file page whose URL is considered a local-network canvas URL. Accepted messages are forwarded to NodeAppModel.handleCanvasA2UIAction(), which sends an agent request. This means a generic local-network/tailnet page loaded in the screen webview can invoke privileged bridge actions without being the bundled scaffold or another exact trusted A2UI URL.",
      "rootCauseAnalysis": "In ScreenWebView.swift, CanvasA2UIActionMessageHandler.userContentController checks message.webView?.url and applies two trust rules: file URLs must satisfy controller.isTrustedCanvasUIURL(url), but all non-file URLs only need controller.isLocalNetworkCanvasURL(url). In ScreenController.swift, isTrustedCanvasUIURL only trusts the exact bundled scaffold file URL, while isLocalNetworkCanvasURL delegates to LocalNetworkURLSupport.isLocalNetworkHTTPURL(url), a broad origin class. In NodeAppModel.swift, screen.onA2UIAction is wired to handleCanvasA2UIAction(), which constructs an agent message and calls sendAgentRequest(). The navigation path also permits arbitrary non-loopback remote URLs via ScreenController.navigate/reload, so once a local-network page is loaded into the screen webview, it inherits bridge authority solely from the broad local-network check.",
      "impact": "An attacker able to cause the screen webview to load a local-network or tailnet-hosted page can trigger the A2UI bridge and dispatch agent requests as if they originated from trusted A2UI UI. This crosses the intended trust boundary and can cause unauthorized agent actions/messages to be sent through the connected gateway.",
      "attackPath": "1) Load a non-file page in the screen webview from a local-network/tailnet HTTP(S) origin. 2) The page posts to the openclawCanvasA2UIAction WKScriptMessage handler. 3) ScreenWebView accepts the message because the URL is not a file URL and passes isLocalNetworkCanvasURL(). 4) The parsed body is forwarded through controller.onA2UIAction. 5) NodeAppModel.han