Skip to content

fix(security): querySelector SyntaxError not caught in AskableContext.resolveExplicitHierarchyParent #305

@vamgan

Description

@vamgan

Summary

AskableContext.resolveExplicitHierarchyParent() in packages/core/src/context.ts (line 161) passed a user-supplied data-askable-parent attribute value directly to querySelector() without a try/catch. An invalid CSS selector (e.g. data-askable-parent=":invalid(") throws a DOMException: SyntaxError, which propagates out of the focus tracking callback and disrupts all subsequent interaction tracking for that element.

The identical bug was previously fixed in observer.ts, but the context.ts copy of the same function was missed.

Impact

Any element with a malformed data-askable-parent attribute silently breaks focus tracking for that element — no focus events fire, and the error may propagate to window.onerror.

Fix

Wrap the querySelector call in a try/catch that returns null on error, matching the existing fix in observer.ts.

Fixed in: claude/create-agents-md-fqfEf

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecurity

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions