Skip to content

Prevent ZeuZ AI browser extension's DOM collection from changing browser state#708

Merged
Zayadul-huq-afnan merged 2 commits into
devfrom
fix-ai-plugin-mutation
Jun 25, 2026
Merged

Prevent ZeuZ AI browser extension's DOM collection from changing browser state#708
Zayadul-huq-afnan merged 2 commits into
devfrom
fix-ai-plugin-mutation

Conversation

@nasif-z

@nasif-z nasif-z commented Jun 25, 2026

Copy link
Copy Markdown
Collaborator

Bug description

  • Running the same TC in debug mode could fail even though it completed successfully in deploy mode.
  • Page was automatically scrolling down in debug.

Root cause

  • Debug mode calls send_dom_variables() for AI context collection.
  • send_dom_variables() used getattr() while inspecting non-JSON shared variables.
  • getattr() can execute Selenium WebElement properties (e.g. WebElement.location_when_scrolled_into_view) and change browser scroll state.

Solution

  • Only call send_dom_variables() when Inspector.ai_plugin is enabled.
  • Use inspect.getattr_static() while collecting non-JSON attribute type metadata so properties are not executed.

nasif-z added 2 commits June 25, 2026 17:49
- prevents executing code during attribute access
- because in the case of `WebDriver` or `WebElement` objects, it could execute browser actions like scrolling
@riz-hossain

Copy link
Copy Markdown
Contributor

🔎 ZeuZ PR Review

Open the full report in ZeuZ: Review findings and apply suggestions

Overview Value
Agents ✅ 4 completed
Suggestions 💡 2

Agent breakdown

→ General Review

Status: ✅ Completed
Suggestions: 0 suggestions

No blocking issues found; the change correctly avoids triggering browser-mutating attribute access during debug DOM collection and gates it behind the AI plugin setting.

→ Security Review

Status: ✅ Completed
Suggestions: 0 suggestions

No security findings in this PR diff. The change narrows DOM collection to the AI plugin path and avoids triggering attribute access side effects, which is a safety improvement rather than a risk.

→ Performance Review

Status: ✅ Completed
Suggestions: 0 suggestions

No material performance regressions found in the PR diff; the new guard reduces debug-time DOM collection, and the fallback attribute inspection change is confined to the non-JSON path.

→ Testing Review

Status: ✅ Completed
Suggestions: 2 suggestions

The PR fixes a behavioral bug in debug mode, but there’s no regression coverage for either the new ai_plugin gate or the non-mutating attribute inspection path.

Open ZeuZ to inspect full findings, continue an agent conversation, or apply safe patch suggestions.

@nasif-z nasif-z changed the title Prevent AI debug DOM collection from changing browser state Prevent ZeuZ AI browser extension's DOM collection from changing browser state Jun 25, 2026
@nasif-z nasif-z marked this pull request as ready for review June 25, 2026 12:39
@nasif-z nasif-z self-assigned this Jun 25, 2026
@Zayadul-huq-afnan Zayadul-huq-afnan self-requested a review June 25, 2026 14:05
@Zayadul-huq-afnan Zayadul-huq-afnan merged commit 05b5f51 into dev Jun 25, 2026
7 checks passed
@Zayadul-huq-afnan Zayadul-huq-afnan deleted the fix-ai-plugin-mutation branch June 25, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants