Automattic / Automattic/harper

The XPI silently discards all reports of erroneous spelling suggestions.

Open
#4,219 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
15.4k
Forks
627
Avg merge
1d 15h
Merged PRs (30d)
102

Description

#### What The Problem Is

Reports of erroneous spelling suggestions are silently discarded:

~~~txt
00:45:49.901 XHR POST
https://writewithharper.com/api/problematic-lints
[HTTP/2 403 153ms]


POST

scheme
https
host
writewithharper.com
filename
/api/problematic-lints
Address
192.0.66.196:443
Status
403
VersionHTTP/2
Transferred255 B (46 B size)
Referrer Policyno-referrer
DNS ResolutionSystem


cache-control
no-cache, must-revalidate, max-age=0, no-store
content-length
46
date
Mon, 24 Aug 2026 23:45:50 GMT
server
nginx
x-cache
BYPASS
X-Firefox-Spdy
h2
x-rq
lhr4 0 40 9980

Accept
*/*
Accept-Encoding
gzip, deflate, br, zstd
Accept-Language
en-GB
Connection
keep-alive
Content-Length
568
Content-Type
multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91
Host
writewithharper.com
Origin
moz-extension://4cf4f57c-6d0a-488c-8633-ede29b2873c8
Priority
u=4
Sec-Fetch-Dest
empty
Sec-Fetch-Mode
cors
Sec-Fetch-Site
same-origin
TE
trailers
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0
~~~

…whereas `$Home/devtools-webextension-fallback_api_problematic-lints_Archive [26-08-25 00-46-10].har` includes:

~~~JSON
{
"log": {
"version": "1.2",
"creator": {
"name": "Firefox",
"version": "156.0a1"
},
"browser": {
"name": "Firefox",
"version": "156.0a1"
},
"pages": [
{
"id": "page_1",
"pageTimings": {
"onContentLoad": -9140,
"onLoad": -9139
},
"startedDateTime": "2026-08-25T00:45:49.901+01:00",
"title": "resource://devtools-webextension-fallback/webextension-fallback.html#harper@writewithharper.com"
}
],
"entries": [
{
"startedDateTime": "2026-08-25T00:45:49.901+01:00",
"request": {
"bodySize": 568,
"method": "POST",
"url": "https://writewithharper.com/api/problematic-lints",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "Host",
"value": "writewithharper.com"
},
{
"name": "User-Agent",
"value": "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0"
},
{
"name": "Accept",
"value": "*/*"
},
{
"name": "Accept-Language",
"value": "en-GB"
},
{
"name": "Accept-Encoding",
"value": "gzip, deflate, br, zstd"
},
{
"name": "Content-Type",
"value": "multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91"
},
{
"name": "Content-Length",
"value": "568"
},
{
"name": "Origin",
"value": "moz-extension://4cf4f57c-6d0a-488c-8633-ede29b2873c8"
},
{
"name": "Connection",
"value": "keep-alive"
},
{
"name": "Sec-Fetch-Dest",
"value": "empty"
},
{
"name": "Sec-Fetch-Mode",
"value": "cors"
},
{
"name": "Sec-Fetch-Site",
"value": "same-origin"
},
{
"name": "Priority",
"value": "u=4"
},
{
"name": "TE",
"value": "trailers"
}
],
"cookies": [],
"queryString": [],
"headersSize": 525,
"postData": {
"mimeType": "multipart/form-data; boundary=----geckoformboundaryc8ff2252c5389fab94b7f64723225c91",
"params": [],
"text": "------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"example\"\r\n\r\nry sending you messages via Outlook. H\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"rule_id\"\r\n\r\nPronounVerbAgreement\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"feedback\"\r\n\r\n\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91\r\nContent-Disposition: form-data; name=\"is_false_positive\"\r\n\r\ntrue\r\n------geckoformboundaryc8ff2252c5389fab94b7f64723225c91--\r\n"
}
},
"response": {
"status": 403,
"statusText": "",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "server",
"value": "nginx"
},
{
"name": "date",
"value": "Mon, 24 Aug 2026 23:45:50 GMT"
},
{
"name": "content-length",
"value": "46"
},
{
"name": "x-rq",
"value": "lhr4 0 40 9980"
},
{
"name": "cache-control",
"value": "no-cache, must-revalidate, max-age=0, no-store"
},
{
"name": "x-cache",
"value": "BYPASS"
},
{
"name": "X-Firefox-Spdy",
"value": "h2"
}
],
"cookies": [],
"content": {
"mimeType": "application/x-unknown-content-type",
"size": 46,
"encoding": "base64",
"text": "Q3Jvc3Mtc2l0ZSBQT1NUIGZvcm0gc3VibWlzc2lvbnMgYXJlIGZvcmJpZGRlbg=="
},
"redirectURL": "",
"headersSize": 209,
"bodySize": 255
},
"cache": {},
"timings": {
"blocked": 0,
"dns": 0,
"connect": 0,
"ssl": 0,
"send": 0,
"wait": 153,
"receive": 0
},
"time": 153,
"_securityState": "secure",
"_priority": "Normal",
"serverIPAddress": "192.0.66.196",
"connection": "443",
"pageref": "page_1"
}
]
}
}
~~~

#### How To Reproduce It

1. Type:

> If this e-mail also replicates the problem, I shall try sending you messages via Outlook.

1. ~~~JS
#!/usr/bin/env firefox-nightly
document.queryySelector('.harper-report-link').click();
document.queryySelector('button.cursor-pointer:nth-child(1)').click();
~~~

[^1]

[^1]: [`bugzilla.mozilla.org/show_bug.cgi?id=2066298`](https://bugzilla.mozilla.org/show_bug.cgi?id=2066298#ct-0:~:text=Whilst%20attempting%20to%20acquire%20button%2Ecursor%2Dpointer:nth%2Dchild%281%29%20from%20the%20WASM/ECMAScript%2Dgenerated%20version%20of%20%5Bthe%20relevant%5D%20moz%2Dextension://$UUID/_generated_background_page%2Ehtml)

#### The Expected Behaviour

The report should be submitted.

#### Screenshots

Image

#### My Environment

I am utilising [`addons.mozilla.org/firefox/downloads/file/4957307/private_grammar_checker_harper-2.8.0.xpi`](https://addons.mozilla.org/firefox/downloads/file/4957307/private_grammar_checker_harper-2.8.0.xpi), on [`packages.mozilla.org/rpm/firefox/Packages/f5a0b5657837e72f15e323d0116c2f8f6d3a041facde934f788f708a9f2a8527-firefox-nightly-156.0a1-20260823213825.x86_64.rpm`](https://packages.mozilla.org/rpm/firefox/Packages/f5a0b5657837e72f15e323d0116c2f8f6d3a041facde934f788f708a9f2a8527-firefox-nightly-156.0a1-20260823213825.x86_64.rpm).

#### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce with Firefox Nightly and the 2.8.0 XPI using the provided text and report-link clicks, then inspect the POST to /api/problematic-lints. Compare the request's extension origin and 403 response with the HAR and the expected successful submission. Done means erroneous-suggestion reports are submitted instead of silently discarded.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, rust, wasm
Domain
api, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.