philc / philc/vimium

[Bug] vimium's `window.forTrusted()` blocks javascript-dispatched events **not only from itself, but from the whole page**

Open
#3,651 17 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
27k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

To Reproduce

Example in chrome; also reproduces the same way in firefox.

  1. Go to a site where vimium works (i.e. example.com)

  2. Devtools > Sources > Enable Listener Breakpoints > Keyboard (check)

  3. Console & dispatch a sample event:

event = new KeyboardEvent("keydown", { key: "Enter" });

element = document.querySelector("body");

element.dispatchEvent(event);
  1. Get thrown back into Sources, straight into the utils.js file from vimium (full path chrome-extension://dbepggeogbaibhgnhhndojpepiihcmeb/lib/utils.js)

  2. See that the event get ignored instead of getting handled, since event.isTrusted !== true.

  3. Explore further with F10; exit from breakpoint with F8

  4. See true get returned from the same place.

That's essentially it. I myself encountered this at gitlab, and, well, I ain't getting those 7 hours of debugging back, so I hope we can fix this so that others don't need to:D

Browser and Vimium version

$ /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
Google Chrome 84.0.4147.135

$ /Applications/Firefox\ Developer\ Edition.app/Contents/MacOS/firefox  --version
Mozilla Firefox 81.0b2

vimium version 1.66 in both

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in lib/utils.js and reproduce the issue using the DevTools Keyboard Listener Breakpoint and the dispatchEvent example from the report. Trace the event handling path and verify that JavaScript-dispatched events from the page are treated correctly without changing the intended handling of Vimium's own events.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.