harden captcha response field injection

Author: esokullu

src/chrome/src/agent/captcha-frame-runtime.js

@@ -1046,6 +1046,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
         }
       });
       if (exact) return { element: exact };
+      return {
+        error: 'The selected CAPTCHA response field ID is no longer present in the target frame.',
+        staleTarget: true,
+      };
     }
     if (Number.isInteger(selectedFieldIndex)) {
       if (fields[selectedFieldIndex]) {
@@ -1073,7 +1077,7 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
     ...field,
     ...resolveResponseField(field.name, field.primary),
   }));
-  const unresolvedField = resolvedFields.find(field => field.error);
+  const unresolvedField = resolvedFields.find(field => field.primary && field.error);
   if (unresolvedField) {
     return {
       success: false,
@@ -1084,6 +1088,8 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
       frameUrl,
     };
   }
+  const skippedFields = resolvedFields.filter(field => !field.primary && field.error);
+  const injectableFields = resolvedFields.filter(field => !field.error);
 
   const setOn = (name, existingElement) => {
     let element = existingElement;
@@ -1116,10 +1122,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
     }
     return element;
   };
-  for (const field of resolvedFields) {
+  for (const field of injectableFields) {
     setOn(field.name, field.element);
   }
-  const fieldsTouched = resolvedFields.length;
+  const fieldsTouched = injectableFields.length;
 
   const pageWindow = frameWindow.wrappedJSObject || frameWindow;
   const callbacks = [];
@@ -1204,8 +1210,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
   return {
     success: true,
     fieldUpdated: true,
-    fieldsUpdated: [fieldName, ...(alsoSet ? [alsoSet] : [])],
+    fieldsUpdated: injectableFields.map(field => field.name),
     fieldsTouched,
+    compatibilityFieldSkipped: skippedFields.length > 0,
+    compatibilityFieldError: skippedFields[0]?.error || null,
     responseFieldId: target.responseFieldId || null,
     responseFieldIndex: Number.isInteger(target.responseFieldIndex)
       ? target.responseFieldIndex

src/firefox/src/agent/captcha-frame-runtime.js

@@ -1046,6 +1046,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
         }
       });
       if (exact) return { element: exact };
+      return {
+        error: 'The selected CAPTCHA response field ID is no longer present in the target frame.',
+        staleTarget: true,
+      };
     }
     if (Number.isInteger(selectedFieldIndex)) {
       if (fields[selectedFieldIndex]) {
@@ -1073,7 +1077,7 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
     ...field,
     ...resolveResponseField(field.name, field.primary),
   }));
-  const unresolvedField = resolvedFields.find(field => field.error);
+  const unresolvedField = resolvedFields.find(field => field.primary && field.error);
   if (unresolvedField) {
     return {
       success: false,
@@ -1084,6 +1088,8 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
       frameUrl,
     };
   }
+  const skippedFields = resolvedFields.filter(field => !field.primary && field.error);
+  const injectableFields = resolvedFields.filter(field => !field.error);
 
   const setOn = (name, existingElement) => {
     let element = existingElement;
@@ -1116,10 +1122,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
     }
     return element;
   };
-  for (const field of resolvedFields) {
+  for (const field of injectableFields) {
     setOn(field.name, field.element);
   }
-  const fieldsTouched = resolvedFields.length;
+  const fieldsTouched = injectableFields.length;
 
   const pageWindow = frameWindow.wrappedJSObject || frameWindow;
   const callbacks = [];
@@ -1204,8 +1210,10 @@ export function injectCaptchaTokenInPage(payload, scope = null) {
   return {
     success: true,
     fieldUpdated: true,
-    fieldsUpdated: [fieldName, ...(alsoSet ? [alsoSet] : [])],
+    fieldsUpdated: injectableFields.map(field => field.name),
     fieldsTouched,
+    compatibilityFieldSkipped: skippedFields.length > 0,
+    compatibilityFieldError: skippedFields[0]?.error || null,
     responseFieldId: target.responseFieldId || null,
     responseFieldIndex: Number.isInteger(target.responseFieldIndex)
       ? target.responseFieldIndex

test/run.js

@@ -52148,16 +52148,35 @@ test('captcha token injection revalidates the selected frame and calls one match
       assert.equal(hiddenCallbackToken, null, `${build}: hidden widget callback was invoked`);
       assert.equal(modalCallbackToken, 'TOKEN_MODAL_WIDGET', `${build}: selected callback was not invoked`);
 
+      hiddenResponse.value = '';
+      modalResponse.value = '';
+      const staleFieldId = runtime.injectCaptchaTokenInPage({
+        fieldName: 'g-recaptcha-response',
+        token: 'TOKEN_STALE_FIELD_ID',
+        target: {
+          frameId: 9,
+          frameUrl: globalThis.location.href,
+          websiteKey: 'KEY_SHARED_WIDGET',
+          responseFieldId: 'g-recaptcha-response-removed',
+          responseFieldIndex: 1,
+        },
+      });
+      assert.equal(staleFieldId.success, false, `${build}: missing selected field ID fell back to an index`);
+      assert.equal(staleFieldId.staleTarget, true, `${build}: missing selected field ID was not marked stale`);
+      assert.equal(hiddenResponse.value, '', `${build}: stale field ID touched the first response field`);
+      assert.equal(modalResponse.value, '', `${build}: stale field ID touched the old indexed response field`);
+
       const canonicalHcaptchaResponse = makeResponse('h-captcha-response-only');
       let createdCompatibilityResponse = null;
+      let hcaptchaCompatibilityResponses = [];
       const hcaptchaHost = {
         getAttribute: (name) => name === 'data-sitekey' ? 'HKEY_CANONICAL_ONLY' : null,
       };
       const hcaptchaDocument = {
         querySelector: () => null,
         querySelectorAll: (selector) => {
           if (selector.includes('h-captcha-response')) return [canonicalHcaptchaResponse];
-          if (selector.includes('g-recaptcha-response')) return [];
+          if (selector.includes('g-recaptcha-response')) return hcaptchaCompatibilityResponses;
           if (selector.includes('[data-sitekey]')) return [hcaptchaHost];
           return [];
         },
@@ -52208,6 +52227,56 @@ test('captcha token injection revalidates the selected frame and calls one match
         `${build}: missing hCaptcha compatibility field was not created`,
       );
 
+      const firstCompatibilityResponse = makeResponse('g-recaptcha-response-first');
+      const secondCompatibilityResponse = makeResponse('g-recaptcha-response-second');
+      hcaptchaCompatibilityResponses = [firstCompatibilityResponse, secondCompatibilityResponse];
+      canonicalHcaptchaResponse.value = '';
+      createdCompatibilityResponse = null;
+      const ambiguousCompatibilityHcaptcha = runtime.injectCaptchaTokenInPage({
+        fieldName: 'h-captcha-response',
+        alsoSet: 'g-recaptcha-response',
+        token: 'TOKEN_HCAPTCHA_AMBIGUOUS_COMPATIBILITY',
+        target: {
+          frameId: 9,
+          frameUrl: hcaptchaWindow.location.href,
+          websiteKey: 'HKEY_CANONICAL_ONLY',
+          responseFieldId: 'h-captcha-response-only',
+          responseFieldIndex: 0,
+          documentTimeOrigin: 123456789,
+        },
+      }, {
+        document: hcaptchaDocument,
+        window: hcaptchaWindow,
+      });
+      assert.equal(
+        ambiguousCompatibilityHcaptcha.success,
+        true,
+        `${build}: ambiguous hCaptcha compatibility fields aborted canonical injection`,
+      );
+      assert.deepEqual(
+        ambiguousCompatibilityHcaptcha.fieldsUpdated,
+        ['h-captcha-response'],
+        `${build}: skipped compatibility field was reported as updated`,
+      );
+      assert.equal(
+        ambiguousCompatibilityHcaptcha.compatibilityFieldSkipped,
+        true,
+        `${build}: compatibility-field skip was not reported`,
+      );
+      assert.match(
+        ambiguousCompatibilityHcaptcha.compatibilityFieldError,
+        /Multiple CAPTCHA response fields/,
+        `${build}: compatibility-field ambiguity diagnostic missing`,
+      );
+      assert.equal(
+        canonicalHcaptchaResponse.value,
+        'TOKEN_HCAPTCHA_AMBIGUOUS_COMPATIBILITY',
+        `${build}: canonical hCaptcha field was not updated after compatibility ambiguity`,
+      );
+      assert.equal(firstCompatibilityResponse.value, '', `${build}: first ambiguous compatibility field was updated`);
+      assert.equal(secondCompatibilityResponse.value, '', `${build}: second ambiguous compatibility field was updated`);
+      assert.equal(createdCompatibilityResponse, null, `${build}: ambiguous compatibility field was recreated`);
+
       responseFields = [response];
       captchaHosts = [host];
       const selectedFrameUrl = globalThis.location.href;