obscura/obscura-inline-script-click-report.md

Obscura inline script click-submit follow-up

Findings

• The existing CDP click-submit parity test was not strong enough to prove inline page scripts loaded by Page.navigate executed in the document.
• I updated crates/obscura-cdp/tests/cdp_click_submit_parity.rs so the served page now includes an inline script with:
  • a global function submitCompat() { location.href = '/submitted'; }
  • a real document.querySelector('button').addEventListener('click', ...) handler that calls submitCompat()
• The test now navigates with CDP Page.navigate, verifies Runtime.evaluate reports typeof submitCompat as function, then obtains the real button element and invokes this.click() through Runtime.callFunctionOn.
• After the click, the test asserts the page navigated to /submitted and the body contains submitted.

Changes made

• Strengthened crates/obscura-cdp/tests/cdp_click_submit_parity.rs only.
• No production code changes were necessary: the strengthened regression test passes against the current implementation.
• SSRF/private-network behavior remains unchanged. The integration test continues to opt in with OBSCURA_ALLOW_PRIVATE_NETWORK=1.
• Did not touch positions.

Verification

• cargo test -p obscura-cdp --test cdp_click_submit_parity -- --nocapture passed.
• cargo test passed.

Notes

• This validates inline script execution and real DOM click listener navigation at the direct CDP dispatch layer. If /home/kcnc/.local/bin/obscura-cdp-click still fails against a live CDP server, the remaining gap is likely in the CLI/server/client path rather than inline script execution during Page.navigate itself.