Mail selected attachment row intercepts its Save to Files button #1254

Open
opened 2026-10-06 23:39:25 +00:00 by kayg · 0 comments
Owner

Mail selected attachment row intercepts Save to Files (#1202)

On release product 139d4378e, tests/adversarial/mail_api.mjs reached the attachment action after its account/input and cross-User guards. At a 1440 × 960 viewport, it opens /mail/t/<fixture-thread>?attachment=<fixture-message>%3A3 and clicks the Save to Files button for the test-only ../../../../etc/passwd attachment. Playwright resolves a visible enabled button but the selected parent row intercepts pointer events.

TimeoutError: click: Timeout 30000ms exceeded.
locator resolved to <button ... aria-label="Save ../../../../etc/passwd to Files">…</button>
<li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events

The final Save to Files/name-safety assertion was not reached. The job did not force-click or replace pointer input with a scripted click. This is a primary-action gap, not a server crash or demonstrated access leak. The main Mail network-policy probe passed, and the cross-User matrix reported zero denial failures. Investigate selected-row hit testing and button stacking, then rerun the actual pointer action. The screenshots for Mail's empty state at all three widths and both themes are attached to #1202; they do not prove this attachment action.

Mail selected attachment row intercepts Save to Files (#1202) On release product `139d4378e`, `tests/adversarial/mail_api.mjs` reached the attachment action after its account/input and cross-User guards. At a 1440 × 960 viewport, it opens `/mail/t/<fixture-thread>?attachment=<fixture-message>%3A3` and clicks the Save to Files button for the test-only `../../../../etc/passwd` attachment. Playwright resolves a visible enabled button but the selected parent row intercepts pointer events. ```text TimeoutError: click: Timeout 30000ms exceeded. locator resolved to <button ... aria-label="Save ../../../../etc/passwd to Files">…</button> <li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events ``` The final Save to Files/name-safety assertion was not reached. The job did not force-click or replace pointer input with a scripted click. This is a primary-action gap, not a server crash or demonstrated access leak. The main Mail network-policy probe passed, and the cross-User matrix reported zero denial failures. Investigate selected-row hit testing and button stacking, then rerun the actual pointer action. The screenshots for Mail's empty state at all three widths and both themes are attached to #1202; they do not prove this attachment action.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1254
No description provided.