Skip to content

fix(cua-driver): refuse minimized Windows element actions - #2849

Merged
f-trycua merged 3 commits into
trycua:mainfrom
biztex:fix/iconic-sentinel-input
Aug 4, 2026
Merged

fix(cua-driver): refuse minimized Windows element actions#2849
f-trycua merged 3 commits into
trycua:mainfrom
biztex:fix/iconic-sentinel-input

Conversation

@biztex

@biztex biztex commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Fixes the silent-no-op half of #2015.

Failure

A minimized Win32 window can report the well-formed iconic rectangle (-32000,-32000)-(-31840,-31972). UIA can mirror that geometry into element bounds, so comparing the element center with the window rectangle succeeds even though the point is on no display. The prior path could then report a successful element action with no visible effect.

Final scope

  • Refuse minimized element clicks before any Windows background route, including UIA patterns and posted-message paths.
  • Return a structured window_minimized refusal with status: refused, effect: refused, and the restore/re-snapshot remedy.
  • Use membership in the live Win32 virtual-desktop bounds instead of a fixed negative-coordinate cutoff, preserving legitimate negative-origin and unusually large monitor layouts.
  • Preserve ScrollIntoView behavior for ordinary coordinate-backed actions.
  • Add a repo-owned WPF cell that minimizes the actual HWND and requires typed refusal, unchanged fixture state, unchanged minimized state, and passing focus, z-order, cursor, no-leaked-input, protocol, and video oracles.
  • Record a resolved-but-refused click without a misleading click marker and validate the canonical minimized-target evidence shape.

Exact-head validation

Validated at 67240b3b4e474e2f37116586464e83ed3685b32e, rebased onto 2be7aab3de35bdffa9d8ad767471c0699d36d6e5:

  • Linux unit and compile: Actions run 30950312757, passed.
  • Cross-OS Rust formatting: Actions run 30950316390, passed.
  • Windows unit and compile: Actions run 30950314573, passed; checkout log confirms the exact head SHA.
  • Native Windows WPF/WinUI3/WebView2: Actions run 30950318327, passed; checkout and CUA_E2E_SOURCE_SHA both confirm the exact head SHA.
  • Native WPF suite: 25 passed, including windows-wpf-minimized-element-click-refusal against a real minimized HWND.
  • Evidence matrix summary: passed; the refusal recording is nonempty/probe-valid and the strict evidence validator accepted it.
  • Local cargo test -p cua-driver-testkit --lib: 50 passed.
  • Local git diff --check and cargo fmt --all -- --check: passed.

The first two commits remain authored by biztex; the maintainer follow-up only aligns refusal recording with the typed action truth.

Refs #2015, #1979, #1981

@biztex
biztex requested a review from f-trycua as a code owner August 4, 2026 16:57
@f-trycua
f-trycua force-pushed the fix/iconic-sentinel-input branch from ddee615 to 72c813d Compare August 4, 2026 19:46
@f-trycua f-trycua changed the title fix(cua-driver/windows): refuse iconic-sentinel element actions fix(cua-driver): refuse minimized Windows element actions Aug 4, 2026
biztex and others added 3 commits August 4, 2026 15:57
Element actions against a minimized window were dispatched to the Win32
iconic position and silently did nothing, while the tool reported success.

Windows parks a minimized window at (-32000, -32000), so GetWindowRect
returns (-32000,-32000)-(-31840,-31972) -- width 160, height 28, both
positive. UIA mirrors that same sentinel into the BoundingRectangle of
every element inside the window, so the cached element center is a
sentinel point and the window rect is a sentinel rect.

point_in_window_bounds then compares one against the other. Because both
sides are poisoned identically, the sentinel center tests as *inside* the
sentinel window rect and the guard passes. The click is posted to
coordinates no monitor covers; nothing happens and no error is raised.
The guard that exists to catch off-screen centers is structurally unable
to catch this case.

Refuse it in resolve_onscreen_point_with_scroll, before the containment
check, on either signal: the resolved point being in the sentinel region,
or IsIconic on the target window. The point test is kept alongside the
authoritative IsIconic call because the reports in trycua#2015 include elements
carrying sentinel bounds while their window appeared visible on a
secondary monitor -- IsIconic alone would not cover that shape.

The error names the remedy (bring_to_front, then re-snapshot), matching
the wording the capture path already uses for the same condition. The
capture and WGC paths have refused iconic windows since trycua#1973/trycua#1974; this
brings the input path in line.

Scope: this fixes the silent no-op. get_window_state still reports the
raw sentinel bounds in elements[].frame -- suppressing or annotating
those changes the response shape, so it is left for a follow-up.

Refs trycua#2015, trycua#1979, trycua#1981
Replace the fixed negative-coordinate heuristic with live virtual-desktop bounds, fail before every element click route, and expose window_minimized as a structured refusal.

Add a real minimized WPF public-driver cell with fixture, focus, z-order, cursor, and leaked-input oracles, plus evidence-validator coverage.
@f-trycua
f-trycua force-pushed the fix/iconic-sentinel-input branch from 084ce1f to 67240b3 Compare August 4, 2026 20:57
@f-trycua
f-trycua merged commit 8a9b7ba into trycua:main Aug 4, 2026
33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants