Selected Mail attachment row intercepts Save to Files clicks #1529

Open
opened 2026-10-09 12:27:04 +00:00 by kayg · 0 comments
Owner

Merge round #1526 reproduced the same Mail attachment click failure on production 5a2c02c13 and the merged candidate.

Run bun tests/adversarial/mail_api.mjs with the production server and CALTERNAL_E2E_ASSET_OVERRIDE=0. The normal real-server fixture opens /mail/t/<thread>?attachment=<message>:3 at 1440 × 960.

Verbatim Playwright evidence:

TimeoutError: click: Timeout 30000ms exceeded.
- waiting for locator('.attachment-list li').filter({ hasText: '../../../../etc/passwd' }).getByRole('button', { name: /to Files$/ })
- element is visible, enabled and stable
- <li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events

The Save to Files button exists and is enabled. Its selected attachment row intercepts pointer events, so the normal click never reaches the action. The scenario stops before it can check the saved filename. This is an inherited UI failure, not a demonstrated traversal or authorization hole.

Keep the existing click and save assertions. Fix the row's pointer hit behavior so the primary action works with pointer and touch. Add keyboard and screen-reader proof, then rerun the hostile filename save check. Use the shared UI components and tokens.

Merge round #1526 reproduced the same Mail attachment click failure on production 5a2c02c13 and the merged candidate. Run `bun tests/adversarial/mail_api.mjs` with the production server and `CALTERNAL_E2E_ASSET_OVERRIDE=0`. The normal real-server fixture opens `/mail/t/<thread>?attachment=<message>:3` at 1440 × 960. Verbatim Playwright evidence: ``` TimeoutError: click: Timeout 30000ms exceeded. - waiting for locator('.attachment-list li').filter({ hasText: '../../../../etc/passwd' }).getByRole('button', { name: /to Files$/ }) - element is visible, enabled and stable - <li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events ``` The Save to Files button exists and is enabled. Its selected attachment row intercepts pointer events, so the normal click never reaches the action. The scenario stops before it can check the saved filename. This is an inherited UI failure, not a demonstrated traversal or authorization hole. Keep the existing click and save assertions. Fix the row's pointer hit behavior so the primary action works with pointer and touch. Add keyboard and screen-reader proof, then rerun the hostile filename save check. Use the shared UI components and tokens.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1529
No description provided.