pathFor: adoptPage trusts a mutable page global and a NUL/replacement-char id can escape-collide
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- playwright, typescript
- Domain
- accessibility, testing-qa
Research direction
Start by locating adoptPage and the path helper, then inspect the duplicate-id fix in #182 and #215. Check how the helper is chosen and how escaped id selectors are validated, including invalid-selector handling. Done means page-defined globals cannot collapse paths and distinct elements with NUL or U+FFFD ids do not share a path; verify with focused tests for both cases.
Written by the indexing model from the issue text.
Description
Follow-up to #182 / #215.
What is wrong
Two residual identity-collision paths remain after the duplicate-id fix:
adoptPageinstalls the path helper only ifwindow.__usablPathForis not already a function. A page that already navigated can define its ownwindow.__usablPathFor = () => '#dup', and adoptPage preserves it, so every element collapses to one identity.- The uniqueness guard checks that the escaped id selector matches exactly one element, not that the match is the element in hand. A NUL id and a literal U+FFFD id both escape to the same selector, so two distinct elements can still collide.
Why it matters
Both reintroduce the set-difference false green the id-collision work closed, for a page that is hostile or has unusual ids.
Fix
Do not trust a mutable page global: evaluate a private path function per query, or install an immutable binding. Before using an id selector, require exactly one match AND matches[0] === element, with invalid-selector handling.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- Avg merge
- 2h 17m
- Merged PRs (30d)
- 10
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from usabl-dev/usabl
-
area: playwright bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
area: engine bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Stop hook allows a stop on an unknown verdict, and the self-check prints IDLE for a null verdictOpenarea: assistants bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
gate() does not check draft enums, so a misspelled evidence class never gatesPossibly taken @eparenti claimed this 1 day ago. Openarea: engine bug security
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Overlay: browser context failures are counted per plugin, not per browser, and close is not sharedOpenarea: overlay bug
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
Similar issues
-
type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
Maintainers usually reply within 1 day
-
0️⃣ phase/new
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 70/100
microsoft/playwright#43640 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100