Selected Mail list row intercepts the reader attachment Save to Files click #1412

Open
opened 2026-10-07 22:26:17 +00:00 by kayg · 0 comments
Owner

Non-blocking pointer/UX finding from #1403's real-server adversarial round using the merged production SPA. tests/adversarial/mail_api.mjs reaches the attachment row but cannot click its Save to Files action.

Verbatim relevant evidence:

TimeoutError: click: Timeout 30000ms exceeded.
waiting for locator('.attachment-list li').filter({ hasText: '../../../../etc/passwd' }).getByRole('button', { name: /to Files$/ })
element is visible, enabled and stable
<li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events

The harness retries 42 times with the same selected list row intercepting the pointer. This is not classified SLOW: the target is ready but another layer owns the hit. The attachment name is a test-only hostile filename; it is not an actual path access or secret.

Investigate stacking/hit testing between the Mail reader and selected message list. Keep the existing real-click assertion; do not force the click or change its expectation. Verify Save to Files and the other reader actions on the real production build, in all input modes and review widths.

No crash, data corruption or authorization failure is shown by this finding. The round continues; Mail's network-policy probe passes. #1403 contains Morph/Split/phone reader captures. Dedicated Mail material/close checks passed, but they do not qualify this attachment click as passed.

Non-blocking pointer/UX finding from #1403's real-server adversarial round using the merged production SPA. `tests/adversarial/mail_api.mjs` reaches the attachment row but cannot click its Save to Files action. Verbatim relevant evidence: ``` TimeoutError: click: Timeout 30000ms exceeded. waiting for locator('.attachment-list li').filter({ hasText: '../../../../etc/passwd' }).getByRole('button', { name: /to Files$/ }) element is visible, enabled and stable <li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events ``` The harness retries 42 times with the same selected list row intercepting the pointer. This is not classified SLOW: the target is ready but another layer owns the hit. The attachment name is a test-only hostile filename; it is not an actual path access or secret. Investigate stacking/hit testing between the Mail reader and selected message list. Keep the existing real-click assertion; do not force the click or change its expectation. Verify Save to Files and the other reader actions on the real production build, in all input modes and review widths. No crash, data corruption or authorization failure is shown by this finding. The round continues; Mail's network-policy probe passes. #1403 contains Morph/Split/phone reader captures. Dedicated Mail material/close checks passed, but they do not qualify this attachment click as passed.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1412
No description provided.