Adversarial: shared Photos root stays empty after opt-in #277

Closed
opened 2026-09-27 21:59:50 +00:00 by kayg · 1 comment
Owner

Evidence

In the real-server cross-plugin probe, User A shared Photos with User B, and User B opted in to Shared/<User A>/Photos as a Photos library root. The timeline endpoint returned HTTP 200 with {"days":[],"next_before":null} for 60 seconds; no active shared photo appeared.

Impact

The recipient cannot see an active shared photo in the Photos timeline after opting in. The response did not expose another User's item details.

Reproduction

Run tests/adversarial/run.sh with the attack2 probes enabled. The isolation section reports Photos shared timeline when the 60-second refresh window expires.

Found during the final adversarial round for #243 after merging dev. The probe ran while other worktrees were also active on the shared host.

### Evidence In the real-server cross-plugin probe, User A shared `Photos` with User B, and User B opted in to `Shared/<User A>/Photos` as a Photos library root. The timeline endpoint returned HTTP 200 with `{"days":[],"next_before":null}` for 60 seconds; no active shared photo appeared. ### Impact The recipient cannot see an active shared photo in the Photos timeline after opting in. The response did not expose another User's item details. ### Reproduction Run `tests/adversarial/run.sh` with the attack2 probes enabled. The `isolation` section reports `Photos shared timeline` when the 60-second refresh window expires. Found during the final adversarial round for #243 after merging `dev`. The probe ran while other worktrees were also active on the shared host.
Author
Owner

Merged into dev by Claude after review (413ccaa7), deploying to calternal.cloud. Closing.

Merged into dev by Claude after review (413ccaa7), deploying to calternal.cloud. Closing.
kayg closed this issue 2026-09-28 23:46:38 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#277
No description provided.