Automattic / Automattic/harper
The XPI silently discards all reports of erroneous spelling suggestions.
- Dominant language
- Rust
- Stars
- 15.4k
- Forks
- 627
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 102
Description
#### What The Problem Is
Reports of erroneous spelling suggestions are silently discarded:
~~~txt
00:45:49.901 XHR POST
https://writewithharper.com/api/problematic-lints
[HTTP/2 403 153ms]
POST
scheme
https
host
writewithharper.com
filename
/api/problematic-lints
Address
192.0.66.196:443
Status
403
VersionHTTP/2
Transferred255 B (46 B size)
Referrer Policyno-referrer
DNS ResolutionSystem
cache-control
no-cache, must-revalidate, max-age=0, no-store
content-length
46
date
Mon, 24 Aug 2026 23:45:50 GMT
server
nginx
x-cache
BYPASS
X-Firefox-Spdy
h2
x-rq
lhr4 0 40 9980
Accept
*/*
Accept-Encoding
gzip, deflate, br, zstd
Accept-Language
en-GB
Connection
keep-alive
Content-Length
568
Content-Type
multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91
Host
writewithharper.com
Origin
moz-extension://4cf4f57c-6d0a-488c-8633-ede29b2873c8
Priority
u=4
Sec-Fetch-Dest
empty
Sec-Fetch-Mode
cors
Sec-Fetch-Site
same-origin
TE
trailers
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0
~~~
…whereas `$Home/devtools-webextension-fallback_api_problematic-lints_Archive [26-08-25 00-46-10].har` includes:
~~~JSON
{
"log": {
"version": "1.2",
"creator": {
"name": "Firefox",
"version": "156.0a1"
},
"browser": {
"name": "Firefox",
"version": "156.0a1"
},
"pages": [
{
"id": "page_1",
"pageTimings": {
"onContentLoad": -9140,
"onLoad": -9139
},
"startedDateTime": "2026-08-25T00:45:49.901+01:00",
"title": "resource://devtools-webextension-fallback/webextension-fallback.html#harper@writewithharper.com"
}
],
"entries": [
{
"startedDateTime": "2026-08-25T00:45:49.901+01:00",
"request": {
"bodySize": 568,
"method": "POST",
"url": "https://writewithharper.com/api/problematic-lints",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "Host",
"value": "writewithharper.com"
},
{
"name": "User-Agent",
"value": "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0"
},
{
"name": "Accept",
"value": "*/*"
},
{
"name": "Accept-Language",
"value": "en-GB"
},
{
"name": "Accept-Encoding",
"value": "gzip, deflate, br, zstd"
},
{
"name": "Content-Type",
"value": "multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91"
},
{
"name": "Content-Length",
"value": "568"
},
{
"name": "Origin",
"value": "moz-extension://4cf4f57c-6d0a-488c-8633-ede29b2873c8"
},
{
"name": "Connection",
"value": "keep-alive"
},
{
"name": "Sec-Fetch-Dest",
"value": "empty"
},
{
"name": "Sec-Fetch-Mode",
"value": "cors"
},
{
"name": "Sec-Fetch-Site",
"value": "same-origin"
},
{
"name": "Priority",
"value": "u=4"
},
{
"name": "TE",
"value": "trailers"
}
],
"cookies": [],
"queryString": [],
"headersSize": 525,
"postData": {
"mimeType": "multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91",
"params": [],
"text": "------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"example\"\r\n\r\nry sending you messages via Outlook. H\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"rule_id\"\r\n\r\nPronounVerbAgreement\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"feedback\"\r\n\r\n\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"is_false_positive\"\r\n\r\ntrue\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91--\r\n"
}
},
"response": {
"status": 403,
"statusText": "",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "server",
"value": "nginx"
},
{
"name": "date",
"value": "Mon, 24 Aug 2026 23:45:50 GMT"
},
{
"name": "content-length",
"value": "46"
},
{
"name": "x-rq",
"value": "lhr4 0 40 9980"
},
{
"name": "cache-control",
"value": "no-cache, must-revalidate, max-age=0, no-store"
},
{
"name": "x-cache",
"value": "BYPASS"
},
{
"name": "X-Firefox-Spdy",
"value": "h2"
}
],
"cookies": [],
"content": {
"mimeType": "application/x-unknown-content-type",
"size": 46,
"encoding": "base64",
"text": "Q3Jvc3Mtc2l0ZSBQT1NUIGZvcm0gc3VibWlzc2lvbnMgYXJlIGZvcmJpZGRlbg=="
},
"redirectURL": "",
"headersSize": 209,
"bodySize": 255
},
"cache": {},
"timings": {
"blocked": 0,
"dns": 0,
"connect": 0,
"ssl": 0,
"send": 0,
"wait": 153,
"receive": 0
},
"time": 153,
"_securityState": "secure",
"_priority": "Normal",
"serverIPAddress": "192.0.66.196",
"connection": "443",
"pageref": "page_1"
}
]
}
}
~~~
#### How To Reproduce It
1. Type:
> If this e-mail also replicates the problem, I shall try sending you messages via Outlook.
1. ~~~JS
#!/usr/bin/env firefox-nightly
document.queryySelector('.harper-report-link').click();
document.queryySelector('button.cursor-pointer:nth-child(1)').click();
~~~
[^1]
[^1]: [`bugzilla.mozilla.org/show_bug.cgi?id=2066298`](https://bugzilla.mozilla.org/show_bug.cgi?id=2066298#ct-0:~:text=Whilst%20attempting%20to%20acquire%20button%2Ecursor%2Dpointer:nth%2Dchild%281%29%20from%20the%20WASM/ECMAScript%2Dgenerated%20version%20of%20%5Bthe%20relevant%5D%20moz%2Dextension://$UUID/_generated_background_page%2Ehtml)
#### The Expected Behaviour
The report should be submitted.
#### Screenshots
#### My Environment
I am utilising [`addons.mozilla.org/firefox/downloads/file/4957307/private_grammar_checker_harper-2.8.0.xpi`](https://addons.mozilla.org/firefox/downloads/file/4957307/private_grammar_checker_harper-2.8.0.xpi), on [`packages.mozilla.org/rpm/firefox/Packages/f5a0b5657837e72f15e323d0116c2f8f6d3a041facde934f788f708a9f2a8527-firefox-nightly-156.0a1-20260823213825.x86_64.rpm`](https://packages.mozilla.org/rpm/firefox/Packages/f5a0b5657837e72f15e323d0116c2f8f6d3a041facde934f788f708a9f2a8527-firefox-nightly-156.0a1-20260823213825.x86_64.rpm).
#### Additional Context
_No response_
Contributor guide
Research direction
Reproduce with Firefox Nightly and the 2.8.0 XPI using the provided text and report-link clicks, then inspect the POST to /api/problematic-lints. Compare the request's extension origin and 403 response with the HAR and the expected successful submission. Done means erroneous-suggestion reports are submitted instead of silently discarded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, rust, wasm
- Domain
- api, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100