fail closed on ambiguous captcha frames

Author: esokullu

src/chrome/src/agent/captcha-frame-runtime.js

@@ -65,6 +65,14 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
   }
 
   const uniqueMatch = (items) => items.length === 1 ? items[0] : null;
+  const httpOrigin = (value) => {
+    try {
+      const parsed = new URL(String(value || ''));
+      return /^https?:$/.test(parsed.protocol) ? parsed.origin : '';
+    } catch (_) {
+      return '';
+    }
+  };
   const findEmbeddingFrame = (frameId, parentFrameId) => {
     const parentContext = contextsByFrameId.get(parentFrameId);
     if (!parentContext) return null;
@@ -91,6 +99,13 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
       const byName = uniqueMatch(childFrames.filter(child => String(child?.name || '') === frameName));
       if (byName) return byName;
     }
+    const frameOrigins = new Set([...frameUrls].map(httpOrigin).filter(Boolean));
+    if (frameOrigins.size) {
+      const byOrigin = uniqueMatch(childFrames.filter(child =>
+        [child?.loadedUrl, child?.url].some(url => frameOrigins.has(httpOrigin(url)))
+      ));
+      if (byOrigin) return byOrigin;
+    }
     return childFrames.length === 1 ? childFrames[0] : null;
   };
 
@@ -112,12 +127,13 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
     const parentVisible = frameIsVisible(parentFrameId, visiting);
     visiting.delete(frameId);
     const embeddingFrame = parentVisible ? findEmbeddingFrame(frameId, parentFrameId) : null;
-    // A cross-origin child can redirect while its embedding iframe keeps the
-    // original src. In that case parent code cannot read loadedUrl, so a
-    // missing match means visibility is unknown rather than hidden. Only
-    // demote when a matched embedding frame is conclusively hidden.
+    // A unique origin match covers common cross-origin redirects whose iframe
+    // keeps its original src. When multiple embedding elements are still
+    // indistinguishable, visibility is unknown; fail closed so an internally
+    // visible widget inside a hidden iframe is not promoted into the paid-task
+    // ranking tier.
     const visible = parentVisible
-      && (embeddingFrame ? embeddingFrame.visible === true : true);
+      && embeddingFrame?.visible === true;
     visibilityByFrameId.set(frameId, visible);
     return visible;
   };

src/firefox/src/agent/captcha-frame-runtime.js

@@ -65,6 +65,14 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
   }
 
   const uniqueMatch = (items) => items.length === 1 ? items[0] : null;
+  const httpOrigin = (value) => {
+    try {
+      const parsed = new URL(String(value || ''));
+      return /^https?:$/.test(parsed.protocol) ? parsed.origin : '';
+    } catch (_) {
+      return '';
+    }
+  };
   const findEmbeddingFrame = (frameId, parentFrameId) => {
     const parentContext = contextsByFrameId.get(parentFrameId);
     if (!parentContext) return null;
@@ -91,6 +99,13 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
       const byName = uniqueMatch(childFrames.filter(child => String(child?.name || '') === frameName));
       if (byName) return byName;
     }
+    const frameOrigins = new Set([...frameUrls].map(httpOrigin).filter(Boolean));
+    if (frameOrigins.size) {
+      const byOrigin = uniqueMatch(childFrames.filter(child =>
+        [child?.loadedUrl, child?.url].some(url => frameOrigins.has(httpOrigin(url)))
+      ));
+      if (byOrigin) return byOrigin;
+    }
     return childFrames.length === 1 ? childFrames[0] : null;
   };
 
@@ -112,12 +127,13 @@ export function applyCaptchaFrameVisibility(candidates, frameContexts, navigatio
     const parentVisible = frameIsVisible(parentFrameId, visiting);
     visiting.delete(frameId);
     const embeddingFrame = parentVisible ? findEmbeddingFrame(frameId, parentFrameId) : null;
-    // A cross-origin child can redirect while its embedding iframe keeps the
-    // original src. In that case parent code cannot read loadedUrl, so a
-    // missing match means visibility is unknown rather than hidden. Only
-    // demote when a matched embedding frame is conclusively hidden.
+    // A unique origin match covers common cross-origin redirects whose iframe
+    // keeps its original src. When multiple embedding elements are still
+    // indistinguishable, visibility is unknown; fail closed so an internally
+    // visible widget inside a hidden iframe is not promoted into the paid-task
+    // ranking tier.
     const visible = parentVisible
-      && (embeddingFrame ? embeddingFrame.visible === true : true);
+      && embeddingFrame?.visible === true;
     visibilityByFrameId.set(frameId, visible);
     return visible;
   };

test/run.js

@@ -51529,6 +51529,62 @@ test('captcha frame visibility propagation demotes descendants of hidden embeddi
       'KEY_REDIRECTED',
       `${build}: redirected visible CAPTCHA lost to another candidate`,
     );
+
+    const unmatchedOpaqueCandidate = {
+      ...nestedCandidate,
+      frameId: 31,
+      frameUrl: 'about:blank',
+      websiteKey: 'KEY_UNMATCHED_OPAQUE',
+    };
+    const unmatchedOpaqueAdjusted = runtime.applyCaptchaFrameVisibility(
+      [visibleCandidate, unmatchedOpaqueCandidate],
+      [
+        {
+          frameId: 0,
+          frameUrl: visibleCandidate.frameUrl,
+          frameName: '',
+          childFrames: [
+            {
+              url: 'about:blank',
+              loadedUrl: 'about:blank',
+              name: '',
+              visible: true,
+            },
+            {
+              url: 'about:blank',
+              loadedUrl: 'about:blank',
+              name: '',
+              visible: false,
+            },
+          ],
+        },
+        {
+          frameId: 31,
+          frameUrl: 'about:blank',
+          frameName: '',
+          childFrames: [],
+        },
+      ],
+      [
+        { frameId: 0, parentFrameId: -1, url: visibleCandidate.frameUrl },
+        { frameId: 31, parentFrameId: 0, url: 'about:blank' },
+      ],
+    );
+    assert.equal(
+      unmatchedOpaqueAdjusted[1].frameVisible,
+      false,
+      `${build}: unmatched opaque child was promoted to visible`,
+    );
+    assert.equal(
+      unmatchedOpaqueAdjusted[1].visible,
+      false,
+      `${build}: unmatched opaque CAPTCHA remained active`,
+    );
+    assert.equal(
+      runtime.selectCaptchaCandidate(unmatchedOpaqueAdjusted).selected.websiteKey,
+      'KEY_VISIBLE',
+      `${build}: unmatched opaque CAPTCHA displaced the proven visible widget`,
+    );
   }
 });