trending/camofox-browser
1
0
Fork 0
mirror of https://github.com/jo-inc/camofox-browser.git synced 2026-10-02 04:14:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(buildRefs): skip PerimeterX/captcha iframes to prevent 30s hang on authenticated clicks

Browse Source 
buildRefs() traverses child frames and runs ariaSnapshot on each one not matched
by IFRAME_SKIP_PATTERNS. Some sites inject a bot-detection iframe (PerimeterX
px-iframe-*/px-captcha, hCaptcha, Arkose/FunCaptcha, DataDome) that is short-lived
and detaches mid-ariaSnapshot. The ariaSnapshot call then hangs until the handler
timeout (30s), and the click/snapshot that triggered the ref rebuild returns a
spurious 500 even though the underlying action succeeded.

Concretely on LinkedIn: PerimeterX is injected on authenticated actions such as
the connection-invite 'Add a note' modal, so every such click 500s and write
flows silently fail.

Fix: add px-iframe/px-captcha/perimeterx/captcha/hcaptcha/arkose/funcaptcha/datadome
to IFRAME_SKIP_PATTERNS so buildRefs skips them (same treatment recaptcha already
gets). Both iframe loops reference this constant, so the single edit covers ref
building and snapshot YAML.

Tested: an automated LinkedIn connection-invite flow that previously 500'd on
profiles showing the intermediate 'Add a note' step now completes and verifies
Pending.
This commit is contained in:
Leone Parise
2026-06-10 14:46:45 -03:00
parent ce3a3b085a
commit 556090ef3c
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+8
View File
@@ -175,6 +175,14 @@ const IFRAME_SKIP_PATTERNS = [
/web-pixel/i, /analytics/i, /tracking/i, /gtm/i, /facebook/i,
/doubleclick/i, /google.*tag/i, /hotjar/i, /segment/i, /sentry/i,
/recaptcha/i, /gstatic/i, /app-bridge/i, /extensions\.shopifycdn/i,
// Bot-detection / anti-automation frames. These are short-lived and frequently
// DETACH mid-ariaSnapshot, which hangs buildRefs until the handler timeout (30s)
// and surfaces as a spurious 500 on the click/snapshot that triggered the rebuild.
// e.g. LinkedIn injects PerimeterX (px-iframe-*/px-captcha) on authenticated
// actions such as the connection-invite modal, so skipping these is required for
// those write flows to work.
/px-iframe/i, /px-captcha/i, /perimeterx/i, /\bcaptcha\b/i, /hcaptcha/i,
/arkose/i, /funcaptcha/i, /datadome/i,
];
const MAX_IFRAMES_TO_PROCESS = 8;
const IFRAME_SNAPSHOT_TIMEOUT_MS = 3000;