ZacharyZhang-NYandClaude Opus 5.5
c5f614d095
Preview clicks and Cmd/Ctrl clicks in the editor go through one click handler; it stops the browser and sends the link mark's own address, since Milkdown blanks unsafe hrefs in the DOM. Reviews run at effort xhigh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.4 KiB
FAIL
-
apps/ely-mark/web/src/visual.js:82: Link activation uses the marks at a rounded caret position instead of the clicked anchor. Real Playwright clicks against freshly built pages reproduce this on native Windows and WSL: in
Go [website](https://example.com/) now., Ctrl-click 1 px inside the link's left edge sends nolinkquery; in[one](https://one.example/)[two](https://two.example/), the same click insidetwosendshttps://one.example/. Clicking just afterwebsitealso activates that link. Resolve the actual clicked anchor, including its descendants, rather than the insertion-position marks. Add regression clicks at both edges and between adjacent links; the current center-click test passes despite these failures. -
crates/ely-office/src/lib.rs:270: The allowed-scheme check is case-sensitive, while the new visual handler forwards the original Markdown address. For
[upper](HTTPS://example.com/), Ctrl-click sendsHTTPS://example.com/andMarkView::followemits the refusal message; preview click produces the normalizedhttps://example.com/and opens outside. Both page paths were verified on Windows and WSL. HTTP, HTTPS and mailto schemes are case-insensitive, so these paths violate the required shared policy. Parse or normalize the scheme consistently before checking it, and test the host's allowed/refused outcome for mixed-case schemes as well as page event delivery.