Repository navigation
Put the address the login ended on into the address field - #256
Merged
Merged
Conversation
The login window returned the cookies and the browser identity, and threw away where the user went. Navigating to the logged-in page by hand is the reason the browser opens at all, so the one page the user came to copy was the one thing they had to type again. The window now returns the WebView's own address, which is where a redirect chain stopped rather than where it started, and the hand-off adds it to the address field on a line of its own. What is already there stays, so the user trims rather than retypes. An address that is not https and naming a host is dropped, because that field is the crawl's own input. WinHTTrack has the same fix; its field starts empty, so the gap stopped the wizard there instead of merely annoying. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <xroche@gmail.com>
The review found the first version wrote secrets to disk. The address field is saved into the project's winprofile.ini, which lives in shared storage, so anything the login reports lands in a world-readable file while the cookies themselves go to private storage owner-only. URI.getHost() returns a host for an address carrying userinfo, so https://user:pass@host/ passed the check, and an OAuth callback carries its code in the query and its token in the fragment. Measured: all three reached winprofile.ini in the clear, and the argv redaction helper covers only the log line. Userinfo is now refused rather than stripped, because the engine would otherwise authenticate with it. The query and fragment are cut. The landed address also had to belong to the site the user asked for. A login that ends on an identity provider would otherwise add that provider as a second crawl root, and the copy would start mirroring someone else's site with a live session. Last, setMap writes the map and not the widget. This field is on the pane the user is looking at, so the old text stayed on screen and the next savePaneFields copied it back over the map: the user never saw the address and could not trim it. The widget is now set too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <xroche@gmail.com>
Deleting the widget write left every test green, so the defect the first round found was fixed and then left unguarded. The wiring test now names that call. setFieldText throws when the view is not inflated, so the write is guarded on the pane that holds the field. The truncation now uses two indexOf calls: it already cut at the earliest separator, because the loop bound doubled as the result, but it read like the opposite bug. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <xroche@gmail.com>
The review noted no test ran a multi-entry field through either answer, which is where a reordering or a dropped entry would show. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <xroche@gmail.com>
xroche
enabled auto-merge (squash)
October 21, 2026 12:00
WinHTTrack keeps the query and cuts only the fragment, so the divergence would otherwise read as an oversight. The reason is that our field is never empty when the login opens, which theirs usually is. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <xroche@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The login window returned the cookies and the browser identity, and threw away where the user went. Reaching the logged-in page by hand is why the browser opens at all. So the one page the user came to copy was the one thing they had to type again.
It now returns the WebView's own address, which is where a redirect chain stopped rather than where it started. The address field shows it for the user to trim. Three gates stand in front of that field, because it is saved into the project's
winprofile.iniin shared storage:A review caught the first two reaching that file in the clear. It also caught the field being written to the map but not the widget, which made the whole thing invisible. A path can still carry a token, because the path is the page the user asked for.
WinHTTrack is taking the same fix.