claude-code - 💡(How to fix) Fix claude-in-chrome: output sanitizer blocks URLs with two query params [1 participants]

TL;DR

The issue can be fixed by modifying the javascript_tool output sanitizer to distinguish between cookie strings and URLs.

Guidance

• The current implementation blocks any string containing = and (; or &), which is too broad and causes false positives for signed URLs.
• To fix this, the sanitizer should check if the string starts with a URL scheme (http:// or https://) before blocking it.
• The condition in the if statement should be updated to account for this, possibly by adding a check for the presence of a URL scheme.
• The updated condition could be if (e.includes("=") && (e.includes(";") || e.includes("&")) && !e.startsWith("http://") && !e.startsWith("https://")).

Example

if (e.includes("=") && (e.includes(";") || e.includes("&")) && !e.startsWith("http://") && !e.startsWith("https://"))
  return "[BLOCKED: Cookie/query string data]";

Notes

This fix assumes that all URLs will start with either http:// or https://, which may not be the case for all possible URLs (e.g., protocol-relative URLs).

Recommendation

Apply workaround: update the sanitizer condition to distinguish between cookie strings and URLs, as described above. This will prevent false positives for signed URLs while still blocking potential cookie/query string data.