Merge35: selected attachment row intercepts Save to Files click #1465

Open
opened 2026-10-08 13:14:44 +00:00 by kayg · 0 comments
Owner

Merge35 (#1458) real-release adversarial Mail probe stopped at a pointer interaction.

tests/adversarial/mail_api.mjs:389 locates the attachment named ../../../../etc/passwd and clicks its real Save to Files button. Playwright resolves a visible, enabled button but retries until the 30-second deadline because a selected <li aria-current="page"> intercepts pointer events.

The hostile filename already reached attachment metadata, as intended by the fixture. The blocked click leaves the basename/safe-write checks after it unverified. There is no evidence here of an accepted path escape, server crash, 5xx or cross-User leak. Existing fixture, click and assertions remain unchanged.

Investigate attachment row geometry, selected-row stacking and the preceding deep-link selection state. Do not replace the real pointer action with a forced click to hide the problem.

Product build 938a141d5, integration head 0ba15bd945. Local log: artifacts/merge35/adversarial.log.

Merge35 (#1458) real-release adversarial Mail probe stopped at a pointer interaction. `tests/adversarial/mail_api.mjs:389` locates the attachment named `../../../../etc/passwd` and clicks its real Save to Files button. Playwright resolves a visible, enabled button but retries until the 30-second deadline because a selected `<li aria-current="page">` intercepts pointer events. The hostile filename already reached attachment metadata, as intended by the fixture. The blocked click leaves the basename/safe-write checks after it unverified. There is no evidence here of an accepted path escape, server crash, 5xx or cross-User leak. Existing fixture, click and assertions remain unchanged. Investigate attachment row geometry, selected-row stacking and the preceding deep-link selection state. Do not replace the real pointer action with a forced click to hide the problem. Product build 938a141d5, integration head 0ba15bd9459c66dd820297474b71d603ca8e637f. Local log: `artifacts/merge35/adversarial.log`.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1465
No description provided.