Skip to content

AutoCua 0.1.9: Windows HTTPS security fix, WebDriverAgent and Chrome no longer downloaded

Latest
Latest

Choose a tag to compare

View all tags
@FunctionFreak FunctionFreak released this 04 Nov 00:27
· 16 commits to main since this release
v0.1.9
03828ab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security fix for Windows: please upgrade

On Windows, AutoCua could switch HTTPS certificate checks off by itself when a check failed. This happened in two places. One was the check that runs before an AI provider is used, which then covered every connection the app made. The other was the Telegram bot. An attacker on the same network, such as public Wi-Fi or a hostile proxy, causes exactly that failure. They could then read API keys, the bot token, prompts and screenshots, or answer as the AI provider.

  • 0.1.9 never turns certificate checks off.
  • When the usual certificate bundle fails, AutoCua checks against the Windows certificate store. An antivirus or company proxy whose root Windows trusts, such as Norton or Defender, keeps working. Gemini now uses the Windows store too.
  • When even Windows rejects the certificate, the run stops with a message that says what to turn off. You can also point SSL_CERT_FILE at the root certificate.
  • The Telegram bot uses the same check, so a firewall block no longer counts as a certificate problem there either. If the bot cannot verify Telegram, it does not start.
  • macOS and Linux never had this fallback and are unchanged.

Affected: Windows, versions 0.1.0 to 0.1.8. Fixed in 0.1.9. Advisory: GHSA-qm8g-cw9j-w2gj

WebDriverAgent and Chrome are never downloaded

  • iOS: WebDriverAgent now lives in AutoCua_data/WebDriverAgent, and AutoCua never downloads it. While it is missing, iOS automation is paused. The terminal and Settings, Connect Device, iPhone show the one git clone command with the full path.
  • Web: Google Chrome is never downloaded or installed. When it is missing, the terminal says so once, the app shows a popup when it starts, and a web run stops cleanly.
  • Android: adb still asks y/N on the terminal. Settings, Connect Device, Android now has an Install adb button. After Yes the app closes, and the next start from the terminal asks.

Install or upgrade

pip install -U autocua

Wheels for macOS (Apple Silicon), Windows x64 and Linux x86_64.

Full Changelog: v0.1.8...v0.1.9

Assets 2
Loading
0 Join discussion