Mail attachment Inspector selected row intercepts Save to Files pointer clicks #1485

Closed
opened 2026-10-08 21:58:44 +00:00 by kayg · 1 comment
Owner

The Mail attachment Inspector's Save to Files button cannot receive a pointer click for the deep-linked selected attachment. A real production cc1af3c12 browser and the merged release both fail the same click. This is pre-existing.

At 1440px, the button bounds are x=277.40625, y=112.25, width=30, height=30. document.elementFromPoint at the button centre returns the selected li[aria-current="page"], not the button. Playwright waits ten seconds and reports pointer interception. The merged full adversarial Mail probe reports the same failure with its thirty-second deadline.

The fixture metadata uses the hostile filename ../../../../etc/passwd. The final assertions for safe saved names cannot run because the primary UI action cannot be clicked. No filesystem escape is established. Keep those assertions unchanged and fix the hit target. DESIGN §§34, 45; found in merge round #1479.

Local evidence: artifacts/merge35b/mail-hit-compare-final.log. Production used its own unmodified fixture from cc1af3c12; the merged test used the merged fixture. Both used the real API and embedded or matching web assets. Clean HTML reader captures are attached to #1479.

The Mail attachment Inspector's Save to Files button cannot receive a pointer click for the deep-linked selected attachment. A real production cc1af3c12 browser and the merged release both fail the same click. This is pre-existing. At 1440px, the button bounds are x=277.40625, y=112.25, width=30, height=30. `document.elementFromPoint` at the button centre returns the selected `li[aria-current="page"]`, not the button. Playwright waits ten seconds and reports pointer interception. The merged full adversarial Mail probe reports the same failure with its thirty-second deadline. The fixture metadata uses the hostile filename `../../../../etc/passwd`. The final assertions for safe saved names cannot run because the primary UI action cannot be clicked. No filesystem escape is established. Keep those assertions unchanged and fix the hit target. DESIGN §§34, 45; found in merge round #1479. Local evidence: `artifacts/merge35b/mail-hit-compare-final.log`. Production used its own unmodified fixture from cc1af3c12; the merged test used the merged fixture. Both used the real API and embedded or matching web assets. Clean HTML reader captures are attached to #1479.
Author
Owner

Deployed to production in merge round 37 (ac7fda1a8, 2026-10-10 21:37 IST).

Deployed to production in merge round 37 (ac7fda1a8, 2026-10-10 21:37 IST).
kayg closed this issue 2026-10-10 16:07:39 +00:00
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1485
No description provided.