Fix bilibili search popup opening detached window#2836
Fix bilibili search popup opening detached window#2836austinywang wants to merge 2 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThese changes add event type classification and gesture-aware navigation routing to the browser panel. They introduce Changes
Sequence DiagramsequenceDiagram
actor User
participant NavigationDelegate as Navigation Delegate
participant GestureDetector as Gesture Detector
participant UIDelegate as UI Delegate
participant Router as Routing Logic
User->>NavigationDelegate: Navigation Action Triggered
NavigationDelegate->>GestureDetector: Check currentEventType
GestureDetector-->>NavigationDelegate: Explicit Gesture? (keyDown/mouse)
alt navigationType == .other
NavigationDelegate->>Router: Check popup creation rules
Router->>Router: Has explicit gesture?
alt Explicit gesture present
Router-->>NavigationDelegate: Reject popup creation
NavigationDelegate->>UIDelegate: Fallback to new tab
else No explicit gesture
Router-->>NavigationDelegate: Allow popup creation
NavigationDelegate->>UIDelegate: Create popup window
end
else navigationType != .other
NavigationDelegate->>Router: Check nil-target fallback
Router->>GestureDetector: Has explicit gesture?
alt Explicit gesture present
Router-->>NavigationDelegate: Fallback to new tab
else No explicit gesture
Router-->>NavigationDelegate: Use standard handling
end
end
UIDelegate-->>User: Navigate in appropriate context
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Sources/Panels/BrowserPanel.swift`:
- Around line 5955-5959: The current check in BrowserPanel.swift (the if using
isUserNewTab and browserNavigationHasExplicitUserGesture(currentEventType:)) is
too broad and downgrades legitimate user-initiated popups; restrict the
gesture-based tab fallback to only the form-submit/same-origin case. Replace the
use of browserNavigationHasExplicitUserGesture(...) with a focused helper (e.g.,
browserNavigationIsUserFormSubmitSameOrigin(currentEventType:)) or add an
explicit condition that detects same-origin form submit/new-tab semantics, and
only return false when isUserNewTab ||
browserNavigationIsUserFormSubmitSameOrigin(...) is true; leave other
explicit-gesture paths (OAuth/payment popups) to continue opening as popups so
window.opener/postMessage flows are preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e8182d55-a3d0-478f-afe5-ee66e1eed138
📒 Files selected for processing (2)
Sources/Panels/BrowserPanel.swiftcmuxTests/BrowserConfigTests.swift
| // User-triggered new-window requests from form submits / clicks should | ||
| // reuse tab semantics; leave popup windows for scripted opener flows. | ||
| if isUserNewTab || browserNavigationHasExplicitUserGesture(currentEventType: currentEventType) { | ||
| return false | ||
| } |
There was a problem hiding this comment.
Don’t suppress all user-gesture .other popups.
This blanket check can downgrade legitimate user-initiated OAuth/payment popups to tabs, which may break window.opener/postMessage flows. Restrict gesture-based tab fallback to the bilibili-like submit case (e.g., same-origin form-submit heuristics), not all explicit gestures.
💡 Suggested direction
func browserNavigationShouldCreatePopup(
navigationType: WKNavigationType,
modifierFlags: NSEvent.ModifierFlags,
buttonNumber: Int,
hasRecentMiddleClickIntent: Bool = false,
currentEventType: NSEvent.EventType? = NSApp.currentEvent?.type,
- currentEventButtonNumber: Int? = NSApp.currentEvent?.buttonNumber
+ currentEventButtonNumber: Int? = NSApp.currentEvent?.buttonNumber,
+ allowGestureFallbackToTab: Bool = false
) -> Bool {
@@
- if isUserNewTab || browserNavigationHasExplicitUserGesture(currentEventType: currentEventType) {
+ if isUserNewTab {
+ return false
+ }
+ if allowGestureFallbackToTab &&
+ browserNavigationHasExplicitUserGesture(currentEventType: currentEventType) {
return false
}
return true
}+let sameOrigin = navigationAction.request.url?.host == webView.url?.host
+let allowGestureFallbackToTab = (navigationAction.navigationType == .other) && sameOrigin
let isScriptedPopup = browserNavigationShouldCreatePopup(
navigationType: navigationAction.navigationType,
modifierFlags: navigationAction.modifierFlags,
buttonNumber: navigationAction.buttonNumber,
- hasRecentMiddleClickIntent: CmuxWebView.hasRecentMiddleClickIntent(for: webView)
+ hasRecentMiddleClickIntent: CmuxWebView.hasRecentMiddleClickIntent(for: webView),
+ allowGestureFallbackToTab: allowGestureFallbackToTab
)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Sources/Panels/BrowserPanel.swift` around lines 5955 - 5959, The current
check in BrowserPanel.swift (the if using isUserNewTab and
browserNavigationHasExplicitUserGesture(currentEventType:)) is too broad and
downgrades legitimate user-initiated popups; restrict the gesture-based tab
fallback to only the form-submit/same-origin case. Replace the use of
browserNavigationHasExplicitUserGesture(...) with a focused helper (e.g.,
browserNavigationIsUserFormSubmitSameOrigin(currentEventType:)) or add an
explicit condition that detects same-origin form submit/new-tab semantics, and
only return false when isUserNewTab ||
browserNavigationIsUserFormSubmitSameOrigin(...) is true; leave other
explicit-gesture paths (OAuth/payment popups) to continue opening as popups so
window.opener/postMessage flows are preserved.
Greptile SummaryThis PR fixes bilibili-style search popups opening as detached windows by introducing
Confidence Score: 4/5Core fix is sound; two P2 gaps in test coverage and OAuth regression risk should be addressed before merge. The keyDown regression is well-covered and the routing logic is correct. However, the existing cmuxTests/BrowserConfigTests.swift — Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[WebKit navigation with targetFrame == nil] --> B{navigationType == .other?}
B -- No --> C[browserNavigationShouldFallbackNilTargetToNewTab true - Open in new tab]
B -- Yes --> D{browserNavigationHasExplicitUserGesture? leftMouse / rightMouse / otherMouse / keyDown}
D -- Yes user gesture --> E[browserNavigationShouldFallbackNilTargetToNewTab true - Open in new tab - Fix]
D -- No gesture scripted --> F[browserNavigationShouldFallbackNilTargetToNewTab false - Fall through to createWebViewWith]
F --> G{browserNavigationShouldCreatePopup?}
G -- navigationType != .other OR isUserNewTab OR gesture --> H[No popup - openInNewTab fallback]
G -- .other AND no gesture AND not user new-tab --> I[isScriptedPopup = true - Create popup window - OAuth preserved]
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| func browserNavigationHasExplicitUserGesture( | ||
| currentEventType: NSEvent.EventType? = NSApp.currentEvent?.type | ||
| ) -> Bool { | ||
| switch currentEventType { | ||
| case .leftMouseDown, .leftMouseUp, | ||
| .rightMouseDown, .rightMouseUp, | ||
| .otherMouseDown, .otherMouseUp, | ||
| .keyDown: | ||
| return true | ||
| default: | ||
| return false | ||
| } | ||
| } |
There was a problem hiding this comment.
browserNavigationHasExplicitUserGesture treats .leftMouseDown/.leftMouseUp as user gestures, so any .other navigation that coincides with those events will be routed away from popup creation. The comment preserved in browserNavigationShouldFallbackNilTargetToNewTab calls out that OAuth/opener flows depend on createWebViewWith returning a live view — but those flows are typically initiated by a button click, meaning NSApp.currentEvent may well be .leftMouseUp when createWebViewWith is invoked on the main thread.
Whether this bites in practice depends on whether WebKit delivers createWebViewWith synchronously within the same event-loop turn as the click (when NSApp.currentEvent is still the mouse event) vs. after the event has been cleared. A test covering currentEventType: .leftMouseUp in the popup-creation path would lock in the intended behaviour and clarify whether click-launched window.open() is expected to produce a popup or fall through to a new tab.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="Sources/Panels/BrowserPanel.swift">
<violation number="1" location="Sources/Panels/BrowserPanel.swift:5957">
P1: This blanket gesture check will suppress popup creation for click-triggered `window.open()` calls (e.g. OAuth/payment flows). WebKit delivers `createWebViewWith` synchronously during JS execution, so `NSApp.currentEvent` is still the mouse event when the delegate fires. Since `browserNavigationHasExplicitUserGesture` matches `.leftMouseDown`/`.leftMouseUp`, any click-initiated popup (which OAuth flows rely on for `window.opener`/`postMessage`) will be downgraded to a tab.
Consider narrowing the gesture fallback to keyboard events only (the bilibili submit case), or adding a same-origin/form-submit heuristic so that click-triggered cross-origin popups are preserved.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
|
||
| // User-triggered new-window requests from form submits / clicks should | ||
| // reuse tab semantics; leave popup windows for scripted opener flows. | ||
| if isUserNewTab || browserNavigationHasExplicitUserGesture(currentEventType: currentEventType) { |
There was a problem hiding this comment.
P1: This blanket gesture check will suppress popup creation for click-triggered window.open() calls (e.g. OAuth/payment flows). WebKit delivers createWebViewWith synchronously during JS execution, so NSApp.currentEvent is still the mouse event when the delegate fires. Since browserNavigationHasExplicitUserGesture matches .leftMouseDown/.leftMouseUp, any click-initiated popup (which OAuth flows rely on for window.opener/postMessage) will be downgraded to a tab.
Consider narrowing the gesture fallback to keyboard events only (the bilibili submit case), or adding a same-origin/form-submit heuristic so that click-triggered cross-origin popups are preserved.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Sources/Panels/BrowserPanel.swift, line 5957:
<comment>This blanket gesture check will suppress popup creation for click-triggered `window.open()` calls (e.g. OAuth/payment flows). WebKit delivers `createWebViewWith` synchronously during JS execution, so `NSApp.currentEvent` is still the mouse event when the delegate fires. Since `browserNavigationHasExplicitUserGesture` matches `.leftMouseDown`/`.leftMouseUp`, any click-initiated popup (which OAuth flows rely on for `window.opener`/`postMessage`) will be downgraded to a tab.
Consider narrowing the gesture fallback to keyboard events only (the bilibili submit case), or adding a same-origin/form-submit heuristic so that click-triggered cross-origin popups are preserved.</comment>
<file context>
@@ -5934,15 +5948,29 @@ func browserNavigationShouldCreatePopup(
+
+ // User-triggered new-window requests from form submits / clicks should
+ // reuse tab semantics; leave popup windows for scripted opener flows.
+ if isUserNewTab || browserNavigationHasExplicitUserGesture(currentEventType: currentEventType) {
+ return false
+ }
</file context>
1 participant
Summary
.othernil-target browser navigations back to tab fallback instead of detached popup windowsCloses #2834
Note
Medium Risk
Changes WebKit popup/new-tab classification for
.othernavigations based on detected user gestures, which could affect edge-case window.open/OAuth flows or form submissions if misclassified.Overview
Refines popup vs tab behavior for WebKit
.othernavigations by introducingbrowserNavigationHasExplicitUserGesture(mouse/button/key events) and using it to avoid creating popup windows for user-triggered actions, reserving popups for likely scripted opener flows.Updates nil-target handling so
.othernavigations with an explicit user gesture now fall back to the new-tab path, and expands DEBUG logging in navigation/popup delegates to include request method/URL, target-frame info, andWKWindowFeatures. Adds regression tests covering key-driven.othernavigations for both popup creation and nil-target fallback.Reviewed by Cursor Bugbot for commit 4c837b3. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Fixes bilibili search opening a detached popup by routing user-initiated
.othernavigations (e.g., key-driven submits) to a tab instead, closing #2834. Scripted/OAuth popups remain unchanged..othernil-target navigations with a user gesture (key or click) to open in a tab instead of a popup.window.opener/postMessage keep working.Written for commit 4c837b3. Summary will update on new commits.
Summary by CodeRabbit
Bug Fixes
Tests