Mail attachment action is blocked by selected row hit target #1535

Open
opened 2026-10-10 11:22:33 +00:00 by kayg · 1 comment
Owner

tests/adversarial/mail_api.mjs reaches the attachment Save to Files UI step after the Mail API assertions. At 1440×960 on /mail/t/<thread>?attachment=..., clicking the button for the ../../../../etc/passwd attachment times out. Playwright reports that the selected .attachment-list li[aria-current="page"] intercepts pointer events for the button. This reproduced twice on 2026-10-10; the preceding Mail API probes passed. Please fix the attachment action hit target or test setup without weakening the path-sanitization assertions.

`tests/adversarial/mail_api.mjs` reaches the attachment Save to Files UI step after the Mail API assertions. At 1440×960 on `/mail/t/<thread>?attachment=...`, clicking the button for the `../../../../etc/passwd` attachment times out. Playwright reports that the selected `.attachment-list li[aria-current="page"]` intercepts pointer events for the button. This reproduced twice on 2026-10-10; the preceding Mail API probes passed. Please fix the attachment action hit target or test setup without weakening the path-sanitization assertions.
Author
Owner

Same root cause as #1485: Calendar AttachmentDeck's global .attachment-actions { pointer-events: none } matched Mail's Inspector class. Fixed on job/ui-mail (Mail class renamed) and job/ui-chrome (AttachmentDeck rule scoped); both land in the next UI merge round.

Same root cause as #1485: Calendar AttachmentDeck's global .attachment-actions { pointer-events: none } matched Mail's Inspector class. Fixed on job/ui-mail (Mail class renamed) and job/ui-chrome (AttachmentDeck rule scoped); both land in the next UI merge round.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1535
No description provided.