thebadking/obscura
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

js: make event.isTrusted false for page-constructed events

Browse Source 
isTrusted was hardcoded to true for every Event, so new Event('x').isTrusted
returned true. Real browsers return false for script-constructed events and
true only for user-agent dispatched ones, so this was a trivial bot-detection
tell (issue #303).

Track trusted events in a closure-private WeakSet that page JS cannot read or
forge; default isTrusted to false. The CDP input pipeline marks its synthesized
mouse/key events trusted via a non-enumerable __obscura_markTrusted helper, so
automation clicks stay trusted like real Chrome over CDP while page-built
events report false.
This commit is contained in:
SGavrl committed 2026-06-17 15:12:04 +00:00
1 parent af2f89a03e
commit 6264e6bfad
2 files changed
+22 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

crates/obscura-cdp/src/domains/input.rs
+11 -11
View File
@@ -23,9 +23,9 @@ pub async fn handle(
var target = (document.elementFromPoint && document.elementFromPoint({x},{y})) || globalThis.__obscura_click_target || document.activeElement || document.body;\
if (!target) return;\
globalThis.__obscura_click_target = target;\
var evt = new MouseEvent('mousedown', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}});\
var evt = globalThis.__obscura_markTrusted(new MouseEvent('mousedown', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}}));\
target.dispatchEvent(evt);\
var click = new MouseEvent('click', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}});\
var click = globalThis.__obscura_markTrusted(new MouseEvent('click', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}}));\
var cancelled = !target.dispatchEvent(click);\
if (!cancelled) {{\
var link = target.closest ? target.closest('a[href]') : null;\
@@ -46,7 +46,7 @@ pub async fn handle(
if (form2 && typeof form2.submit === 'function') {{ try {{ form2.submit(target); }} catch(e) {{}} }}\
}} else if (tag === 'INPUT' && (type === 'checkbox' || type === 'radio')) {{\
target.checked = !target.checked;\
try {{ target.dispatchEvent(new Event('change', {{bubbles:true}})); }} catch(e) {{}}\
try {{ target.dispatchEvent(globalThis.__obscura_markTrusted(new Event('change', {{bubbles:true}}))); }} catch(e) {{}}\
}}\
}}\
}}\
@@ -62,7 +62,7 @@ pub async fn handle(
"(function() {{\
var target = (document.elementFromPoint && document.elementFromPoint({x},{y})) || globalThis.__obscura_click_target || document.activeElement || document.body;\
if (!target) return;\
var evt = new MouseEvent('mouseup', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}});\
var evt = globalThis.__obscura_markTrusted(new MouseEvent('mouseup', {{bubbles:true,cancelable:true,clientX:{x},clientY:{y},button:0}}));\
target.dispatchEvent(evt);\
}})()",
x = x, y = y,
@@ -85,7 +85,7 @@ pub async fn handle(
let js = format!(
"(function() {{\
var target = document.activeElement || document.body;\
var evt = new KeyboardEvent('keydown', {{bubbles:true,cancelable:true,key:'{key}',code:'{code}'}});\
var evt = globalThis.__obscura_markTrusted(new KeyboardEvent('keydown', {{bubbles:true,cancelable:true,key:'{key}',code:'{code}'}}));\
target.dispatchEvent(evt);\
}})()",
key = key.replace('\'', "\\'"),
@@ -102,7 +102,7 @@ pub async fn handle(
var target = document.activeElement;\
if (target && (target.localName === 'input' || target.localName === 'textarea')) {{\
target.value = (target.value || '') + '{text}';\
target.dispatchEvent(new Event('input', {{bubbles:true}}));\
target.dispatchEvent(globalThis.__obscura_markTrusted(new Event('input', {{bubbles:true}})));\
}}\
}})()",
text = escaped_text,
@@ -118,10 +118,10 @@ pub async fn handle(
let js = "(function() {\
var target = document.activeElement;\
if (!target) return;\
target.dispatchEvent(new KeyboardEvent('keypress', {bubbles:true,key:'Enter',code:'Enter'}));\
target.dispatchEvent(globalThis.__obscura_markTrusted(new KeyboardEvent('keypress', {bubbles:true,key:'Enter',code:'Enter'})));\
if (target.localName === 'textarea') {\
target.value = (target.value || '') + '\\n';\
target.dispatchEvent(new Event('input', {bubbles:true}));\
target.dispatchEvent(globalThis.__obscura_markTrusted(new Event('input', {bubbles:true})));\
} else {\
var form = target.form || (target.closest && target.closest('form'));\
if (form && typeof form.submit === 'function') form.submit();\
@@ -135,7 +135,7 @@ pub async fn handle(
var target = document.activeElement;\
if (target && (target.localName === 'input' || target.localName === 'textarea')) {\
target.value = target.value.slice(0, -1);\
target.dispatchEvent(new Event('input', {bubbles:true}));\
target.dispatchEvent(globalThis.__obscura_markTrusted(new Event('input', {bubbles:true})));\
}\
})()";
page.evaluate(js);
@@ -145,7 +145,7 @@ pub async fn handle(
let js = format!(
"(function() {{\
var target = document.activeElement || document.body;\
var evt = new KeyboardEvent('keyup', {{bubbles:true,key:'{key}',code:'{code}'}});\
var evt = globalThis.__obscura_markTrusted(new KeyboardEvent('keyup', {{bubbles:true,key:'{key}',code:'{code}'}}));\
target.dispatchEvent(evt);\
}})()",
key = key.replace('\'', "\\'"),
@@ -160,7 +160,7 @@ pub async fn handle(
var target = document.activeElement;\
if (target && (target.localName === 'input' || target.localName === 'textarea')) {{\
target.value = (target.value || '') + '{text}';\
target.dispatchEvent(new Event('input', {{bubbles:true}}));\
target.dispatchEvent(globalThis.__obscura_markTrusted(new Event('input', {{bubbles:true}})));\
}}\
}})()",
text = text.replace('\'', "\\'").replace('\\', "\\\\"),