fix: sanitize URLs with vbscript:
The vbscript: protocols can be used to run scripts in much the same way as the javascript: protocol. This PR adds in validation for those aforementioned protocols in snapshotterInjected.ts and snapshotRenderer.ts.
This restores the old hit target check, in addition to the new
hit target interceptor.
This way, we got some coverage for iframes and other quirky cases,
but keep the bullet-proof hit target check in place.
Fixes focus and blur management when `page.locator(…).focus()` and `page.locator(…).type(…)` are used which was regressed by 7a5b070 (#13510).
#13510 relied on an implicit assumption that this (conditional) [`blur`](7a5b070e95/packages/playwright-core/src/server/injected/injectedScript.ts (L672)) call would always be followed by a call that resulted in a newly focused element via this [`focus`](7a5b070e95/packages/playwright-core/src/server/injected/injectedScript.ts (L674)) call.
However, some elements are [not focusable](https://html.spec.whatwg.org/multipage/interaction.html#focusable-area), so we were blurring incorrectly, and losing focus that we should have maintained.
Two regression tests were added that pass on the commit prior to 7a5b070e9507b622877a2af010373585f2184196 (and match manual testing/expectations):
* `page.locator(…).focus()`: _keeps focus on element when attempting to focus a non-focusable element_
* `page.locator(…).type(…)`: _should type repeatedly in input in shadow dom_
Additionally, a third test (_should type repeatedly in input in shadow dom_) was added to check the invariant from #13510 that states:
> This affects [contenteditable] elements, but not input elements.
and allows us to introduce the targeted fix (contenteditble check before blur) without breaking FF again.
And _should type repeatedly in contenteditable in shadow dom with nested elements_ was added to ensure the above fix works with nest contenteditble detection.
Fixes#14254.
References #14037.
We used to query and save all non-zero `scrollTop`/`scrollLeft` to restore the page perfectly. However, this became very slow with Chromium v100 regression (see issue).
This change only queries and stores `scrollTop`/`scrollLeft` for elements that are ancestors of the action target. The resulting snapshot does not perfectly recreate the original screen, but should be good enough to inspect the action.
fix(chromium): work around about:blank issue on Chromium
We don't receive the `loaderId` which translates to `newDocumentId`,
so we expect the same-document navigation. Instead, we can wait
for any new-document navigation as a workaround, only for `about:blank`.
This also reverts commit f0f65fa247ac9cb594acd45b52dc851e60109172.
We should not fast-return if someone tries to run
`npx playwright install-deps` on Debian.
Instead, we should warn users, fallback to Ubuntu 20.04 dependencies,
and proceed.
Currently, when I choose "Java" in the sources list and then
click on the page to generate the "click" action, sources reset
to "JavaScript". This is very inconvenient.
This changes the logic to only forcefully change files if either
old or new file is a user file, not a generated one.
Use cases considered:
- run `codegen`, click around, choose different language, click more;
- run script with inspector, pause, click "Record" and record an action;
- same as above, but then continue and see that user source is revealed.
