Files
obscura/obscura-inline-script-click-report.md
T
Alexandr KondakovandSGavrl 6dd1e4e65f Fix CDP click submit navigation parity (#69)
* Fix Runtime.evaluate awaitPromise settling

* Fix DOM event navigation side effects

* Fix CDP click-triggered navigation parity

* Strengthen CDP inline script click parity test

* Handle positions-like submit URLs in CDP parity


Co-authored-by: SGavrl <[email protected]>
2026-05-15 20:38:54 +00:00

27 lines
1.6 KiB
Markdown

# Obscura inline script click-submit follow-up
## Findings
- The existing CDP click-submit parity test was not strong enough to prove inline page scripts loaded by `Page.navigate` executed in the document.
- I updated `crates/obscura-cdp/tests/cdp_click_submit_parity.rs` so the served page now includes an inline script with:
- a global `function submitCompat() { location.href = '/submitted'; }`
- a real `document.querySelector('button').addEventListener('click', ...)` handler that calls `submitCompat()`
- The test now navigates with CDP `Page.navigate`, verifies `Runtime.evaluate` reports `typeof submitCompat` as `function`, then obtains the real button element and invokes `this.click()` through `Runtime.callFunctionOn`.
- After the click, the test asserts the page navigated to `/submitted` and the body contains `submitted`.
## Changes made
- Strengthened `crates/obscura-cdp/tests/cdp_click_submit_parity.rs` only.
- No production code changes were necessary: the strengthened regression test passes against the current implementation.
- SSRF/private-network behavior remains unchanged. The integration test continues to opt in with `OBSCURA_ALLOW_PRIVATE_NETWORK=1`.
- Did not touch positions.
## Verification
- `cargo test -p obscura-cdp --test cdp_click_submit_parity -- --nocapture` passed.
- `cargo test` passed.
## Notes
- This validates inline script execution and real DOM click listener navigation at the direct CDP dispatch layer. If `/home/kcnc/.local/bin/obscura-cdp-click` still fails against a live CDP server, the remaining gap is likely in the CLI/server/client path rather than inline script execution during `Page.navigate` itself.