Possible exploit: auto-clicking webapp

There is a probability of edge case where Mastodon web application might be exploited by some instance admin (or fork by association) to automatically click “boost”, “favourite”, “follow”, etc., which can go undetected for enough time.

To recap, web application will be able to do malicious actions on behalf of the extension’s user (there is few that it can do, but still significant). Already seeing a potential for dispatchEvent there.

I don’t yet know how to warrant solid safety from this exploit, here are just some options I considered:

• place a warning in extension’s menu;
• make up a list of possible violators as a blacklist (which is not really an option, given the little age of window for exploit);
• intercept such clicks, but somehow detect whether they were really done by hand (should find a way that can’t be reproduced by a script) - if action is not made by user interation, simply don’t mirror it to original instance.

[vintprox]

Found out that Event.isTrusted is one reliable way to check for genuine user click/press.

Even redefining custom event interface with faked isTrusted = true won’t pass the error like Uncaught TypeError: can't redefine non-configurable property "isTrusted".

Doing a PR now 😊👍

[vintprox]

Ah, OK, I was very busy lately anyway, so I appreciate you taking it over, @Lartsch. Good stuff!