SGavrl 6264e6bfad js: make event.isTrusted false for page-constructed events ...

isTrusted was hardcoded to true for every Event, so new Event('x').isTrusted
returned true. Real browsers return false for script-constructed events and
true only for user-agent dispatched ones, so this was a trivial bot-detection
tell (issue #303).

Track trusted events in a closure-private WeakSet that page JS cannot read or
forge; default isTrusted to false. The CDP input pipeline marks its synthesized
mouse/key events trusted via a non-enumerable __obscura_markTrusted helper, so
automation clicks stay trusted like real Chrome over CDP while page-built
events report false.

2026-06-17 15:12:04 +00:00

..

domains

js: make event.isTrusted false for page-constructed events

2026-06-17 15:12:04 +00:00

cookie_params.rs

feat(cdp): implement Network.setCookie + deleteCookies, full field fidelity (#170)

2026-05-25 17:58:48 +02:00

dispatch.rs

Add Target.targetInfoChanged and DOMSnapshot.captureSnapshot for DOM agents (#282)

2026-06-09 21:02:04 +00:00

lib.rs

feat(cli): --allow-private-network for localhost development (#33) (#203)

2026-05-29 17:53:23 +00:00

server.rs

feat(stealth): many stealth improvements

2026-06-03 08:21:14 +00:00

types.rs

Initial Release

2026-04-13 12:30:28 +02:00

util.rs

fix(cdp): gate Target.createTarget file:// like Page.navigate

2026-05-16 15:26:58 +00:00