ZacharyZhang-NYandClaude Opus 5.5
c5f614d095
Preview clicks and Cmd/Ctrl clicks in the editor go through one click handler; it stops the browser and sends the link mark's own address, since Milkdown blanks unsafe hrefs in the DOM. Reviews run at effort xhigh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
6 lines
1.4 KiB
Markdown
6 lines
1.4 KiB
Markdown
FAIL
|
|
|
|
- apps/ely-mark/web/src/visual.js:82: Link activation uses the marks at a rounded caret position instead of the clicked anchor. Real Playwright clicks against freshly built pages reproduce this on native Windows and WSL: in `Go [website](https://example.com/) now.`, Ctrl-click 1 px inside the link's left edge sends no `link` query; in `[one](https://one.example/)[two](https://two.example/)`, the same click inside `two` sends `https://one.example/`. Clicking just after `website` also activates that link. Resolve the actual clicked anchor, including its descendants, rather than the insertion-position marks. Add regression clicks at both edges and between adjacent links; the current center-click test passes despite these failures.
|
|
|
|
- crates/ely-office/src/lib.rs:270: The allowed-scheme check is case-sensitive, while the new visual handler forwards the original Markdown address. For `[upper](HTTPS://example.com/)`, Ctrl-click sends `HTTPS://example.com/` and `MarkView::follow` emits the refusal message; preview click produces the normalized `https://example.com/` and opens outside. Both page paths were verified on Windows and WSL. HTTP, HTTPS and mailto schemes are case-insensitive, so these paths violate the required shared policy. Parse or normalize the scheme consistently before checking it, and test the host's allowed/refused outcome for mixed-case schemes as well as page event delivery.
|