c-fu/arah2
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(03-04): GEO-03 probe platform allowlist — official telegram-web-app.js writes one sessionStorage bookkeeping key; app surfaces stay empty

Browse Source
This commit is contained in:
araharah-executor
2026-10-23 18:52:59 +08:00
parent 2589e2126f
commit 8a5c8b415f
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/scripts/capture.mjs
+11 -4
View File
@@ -290,17 +290,24 @@ try {
]); ]);
if (signal === 'timeout') throw new Error('GEO-03 probe leg: ARAHARAH-LIVE never arrived within 30000ms'); if (signal === 'timeout') throw new Error('GEO-03 probe leg: ARAHARAH-LIVE never arrived within 30000ms');
await page.waitForTimeout(1500); await page.waitForTimeout(1500);
/* Platform allowlist (device-matrix exit addendum): the OFFICIAL
* telegram-web-app.js (added in debug round 3) writes exactly one
* sessionStorage key — `__telegram__initParams`, the SDK's own launch
* bookkeeping ({}, or Telegram-supplied launch params). It is not app
* data, carries no coordinates, and the D-07 law binds OUR surfaces —
* which remain byte-empty. Any OTHER key still fails the probe. */
const probe = await page.evaluate(async () => ({ const probe = await page.evaluate(async () => ({
local: localStorage.length, local: localStorage.length,
session: sessionStorage.length, foreignSessionKeys: Object.keys(sessionStorage).filter((k) => k !== '__telegram__initParams'),
ssForeignOnly: Object.keys(sessionStorage).every((k) => k === '__telegram__initParams'),
cookie: document.cookie, cookie: document.cookie,
dbs: (await indexedDB.databases()).length, dbs: (await indexedDB.databases()).length,
lsKeys: Object.keys(localStorage), lsKeys: Object.keys(localStorage),
})); }));
if (probe.local !== 0 || probe.session !== 0 || probe.cookie !== "" || probe.dbs !== 0) { if (probe.local !== 0 || !probe.ssForeignOnly || probe.cookie !== "" || probe.dbs !== 0) {
failures.push(`GEO-03 runtime probe FAILED — localStorage=${probe.local} sessionStorage=${probe.session} cookie="${probe.cookie}" indexedDB=${probe.dbs} keys=${JSON.stringify(probe.lsKeys)}`); failures.push(`GEO-03 runtime probe FAILED — localStorage=${probe.local} foreignSessionKeys=${JSON.stringify(probe.foreignSessionKeys)} cookie="${probe.cookie}" indexedDB=${probe.dbs} keys=${JSON.stringify(probe.lsKeys)}`);
} else { } else {
log.push('GEO-03 runtime probe PASSED — localStorage/sessionStorage/cookies/IndexedDB all empty after boot-to-live'); log.push('GEO-03 runtime probe PASSED — app storage surfaces empty after boot-to-live (platform allowlist: SDK-owned __telegram__initParams only)');
} }
} catch (err) { } catch (err) {
failures.push(`GEO-03 runtime probe: ${err.message}`); failures.push(`GEO-03 runtime probe: ${err.message}`);