Prevent ZeuZ AI browser extension's DOM collection from changing browser state#708
Conversation
- prevents executing code during attribute access - because in the case of `WebDriver` or `WebElement` objects, it could execute browser actions like scrolling
🔎 ZeuZ PR ReviewOpen the full report in ZeuZ: Review findings and apply suggestions
Agent breakdown→ General ReviewStatus: ✅ Completed No blocking issues found; the change correctly avoids triggering browser-mutating attribute access during debug DOM collection and gates it behind the AI plugin setting. → Security ReviewStatus: ✅ Completed No security findings in this PR diff. The change narrows DOM collection to the AI plugin path and avoids triggering attribute access side effects, which is a safety improvement rather than a risk. → Performance ReviewStatus: ✅ Completed No material performance regressions found in the PR diff; the new guard reduces debug-time DOM collection, and the fallback attribute inspection change is confined to the non-JSON path. → Testing ReviewStatus: ✅ Completed The PR fixes a behavioral bug in debug mode, but there’s no regression coverage for either the new
|
Bug description
Root cause
send_dom_variables()for AI context collection.send_dom_variables()usedgetattr()while inspecting non-JSON shared variables.getattr()can execute SeleniumWebElementproperties (e.g.WebElement.location_when_scrolled_into_view) and change browser scroll state.Solution
send_dom_variables()whenInspector.ai_pluginis enabled.inspect.getattr_static()while collecting non-JSON attribute type metadata so properties are not executed.