RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

feat(browse): allowlist Input.dispatchMouseEvent for trusted mouse gestures 

Some widgets only open on a genuine OS-level mouse event and ignore all
JS/synthetic clicks (verified on Personio's Gefahrtarifstelle "Monat
auswählen" dropdown, 2026-07-03). Add Input.dispatchMouseEvent to
CDP_ALLOWLIST (scope: tab, output: trusted) so `$B cdp` can force a real
click. Delivers input to the focused tab only; returns just an ack (no
page content), so no exfil/injection vector. cdp-allowlist.test.ts: 6 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Philipp Desgranges 2026-07-03 12:21:31 +02:00
parent dc6252d1df
commit 930fc54fb7
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
browse/src/cdp-allowlist.ts
View File

@ -199,6 +199,14 @@ export const CDP_ALLOWLIST: ReadonlyArray<CdpAllowEntry> = Object.freeze([
output: 'untrusted', output: 'untrusted',
justification: 'Inspect properties of an existing remote object. Read-only; output may contain page data.', justification: 'Inspect properties of an existing remote object. Read-only; output may contain page data.',
}, },
// ─── Input (synthetic trusted user gestures) ───────────────
{
domain: 'Input',
method: 'dispatchMouseEvent',
scope: 'tab',
output: 'trusted',
justification: 'Trusted mouse gesture for widgets that ignore JS clicks (e.g. Personio Gefahrtarifstelle "Monat auswählen" dropdown). Focused tab only; returns an ack, no page content.',
},
]); ]);
const CDP_ALLOWLIST_INDEX: Map<string, CdpAllowEntry> = new Map( const CDP_ALLOWLIST_INDEX: Map<string, CdpAllowEntry> = new Map(