AG-52680 Fix 'trusted-click-element' — throws error when trying to set 'cancelBubble'. #555

Squashed commit of the following:

commit 4b6fd24
Merge: d72139c 0330774
Author: Adam Wróblewski <adam@adguard.com>
Date:   Thu Apr 2 16:43:29 2026 +0200

    Merge branch 'master' into fix/AG-52680

commit d72139c
Author: Adam Wróblewski <adam@adguard.com>
Date:   Thu Apr 2 12:28:37 2026 +0200

    Fix `trusted-click-element` to allow setting `cancelBubble` without errors in spoofed events

Author: AdamWr

CHANGELOG.md

@@ -21,8 +21,14 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 - Support for `JSONPath` in `json-prune`, `json-prune-fetch-response`, `json-prune-xhr-response`,
   `trusted-json-set`, `trusted-json-set-fetch-response` and `trusted-json-set-xhr-response` scriptlets [#522].
 
+### Fixed
+
+- `trusted-click-element` no longer throws when event handlers set `cancelBubble`
+  on spoofed events [#555].
+
 [Unreleased]: https://github.com/AdguardTeam/Scriptlets/compare/v2.3.1...HEAD
 [#522]: https://github.com/AdguardTeam/Scriptlets/issues/522
+[#555]: https://github.com/AdguardTeam/Scriptlets/issues/555
 
 ## [v2.3.1] - 2026-03-24
 

src/helpers/click-utils.ts

@@ -91,6 +91,11 @@ export const spoofClickEventsIsTrusted = (): void => {
                     }
                     return val;
                 },
+                // Required for setting properties like "cancelBubble" in event handlers
+                // https://github.com/AdguardTeam/Scriptlets/issues/555
+                set(target, prop, value) {
+                    return Reflect.set(target, prop, value);
+                },
             });
             if (isFn) {
                 return (listener as EventListener).call(this, proxied);

tests/scriptlets/trusted-click-element.test.js

@@ -1227,6 +1227,44 @@ test('isTrusted spoofing - removeEventListener works with EventListenerObject',
     }, 150);
 });
 
+test('cancelBubble can be set without error in spoofed event', (assert) => {
+    const ASSERTIONS = 4;
+    assert.expect(ASSERTIONS);
+    const done = assert.async();
+
+    const selectorsString = `#${PANEL_ID} > #${CLICKABLE_NAME}1`;
+
+    // Run scriptlet before adding event listener to ensure isTrusted is spoofed
+    // and before creating the panel and clickable to ensure they are tracked by the scriptlet
+    runScriptlet(name, [selectorsString]);
+
+    const panel = createPanel();
+
+    const clickable = createClickable(1);
+    panel.appendChild(clickable);
+
+    let receivedIsTrusted = null;
+    let cancelBubbleIsSet = null;
+    clickable.addEventListener('click', (e) => {
+        try {
+            receivedIsTrusted = e.isTrusted;
+            e.cancelBubble = true;
+            cancelBubbleIsSet = e.cancelBubble;
+        } catch (error) {
+            console.error('Error in click event listener:', error);
+            cancelBubbleIsSet = false;
+        }
+    });
+
+    setTimeout(() => {
+        assert.ok(clickable.getAttribute('clicked'), 'Element should be clicked');
+        assert.strictEqual(receivedIsTrusted, true, 'isTrusted should be spoofed to true');
+        assert.strictEqual(cancelBubbleIsSet, true, 'cancelBubble should be settable to true');
+        assert.strictEqual(window.hit, 'FIRED', 'hit func executed');
+        done();
+    }, 150);
+});
+
 test('isTrusted is spoofed for onclick events', (assert) => {
     const ASSERTIONS = 3;
     assert.expect(ASSERTIONS);