Import portable browser profile data - #229
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Import bookmarks, recent history, local storage, and selected Web Store extensions alongside cookies. Keep values local until final approval, enforce the API payload bounds in the CLI, and apply extension entitlements before upload.
f332a7a to
3bb2059
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3bb2059. Configure here.
| if len(selected) > 0 { | ||
| if _, ok := selected[origin]; !ok { | ||
| continue | ||
| } |
There was a problem hiding this comment.
Empty storage selection exports everything
High Severity
ExportLocalStorage treats an empty origin list as “all origins.” After the 64 MiB site picker, chooseLocalStorageSites returns the raw multi-select result with no empty or size check, so deselecting every site uploads all local storage. An oversized selection is also accepted and only fails later, after cookie values are decrypted.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 3bb2059. Configure here.
1 participant
What
Extend
kernel profiles import-localbeyond cookies to import approved portable browser data from Chrome and Helium on macOS:--dayswindow, selected by defaultPasswords and supported TOTP seeds remain a separate Managed Auth step. IndexedDB, cache, arbitrary preferences, and extension state are intentionally excluded.
Why
A useful imported profile needs more than cookies. This keeps the moment-to-magic flow simple while preserving a portable, bounded contract and making sensitive categories visible before upload. History uses actual visits in the chosen time window instead of lifetime URL counters.
How
cookies_importedJSON field while adding per-category resultsDepends on kernel/kernel PR #3244 for server-side extension persistence and entitlement enforcement.
Verification
go test ./internal/browserimport ./cmd -count=1go vet ./internal/browserimport ./cmdgo mod tidy -diffgit diff --checkmake buildNote
High Risk
Reads and uploads sensitive browser data (cookies, history, localStorage) from live Chromium profiles, with new LevelDB snapshotting and a tighter 64 MiB bundle contract. Mistakes in origin filtering or size fallback could leak extra data or fail imports.
Overview
kernel profiles import-localnow imports bookmarks, history (from--days, default on), and localStorage alongside cookies. Users pick categories (and storage origins over 64 MiB) from metadata, then confirm before values are exported and uploaded.Bundles are built with
BuildProfileBundle(cookies/storage/history JSONL + bookmarks JSON). Compressed size is capped at 64 MiB. If the bundle is too large, the CLI drops the largest storage origins first, then history, and asks to continue; cookies and bookmarks stay. Non-interactive runs fail instead of shrinking.Chromium readers snapshot History SQLite and Local Storage LevelDB, keep only http(s) origins, and enforce 100k-record / 1 MiB-record / 16–64 MiB category limits. JSON output adds
browser_data_imported. Dashboard connector imports history by default and forwardsKERNEL_*env fromlaunchctl.Reviewed by Cursor Bugbot for commit 3bb2059. Bugbot is set up for automated code reviews on this repo. Configure here.