search

philc / vimium

The hacker's browser.
https://chrome.google.com/webstore/detail/vimium/dbepggeogbaibhgnhhndojpepiihcmeb
MIT License
23.53k stars 2.49k forks source link

Feature Request: Block all keystrokes-to-website except when in insert mode #3538

Open leoegorov opened 4 years ago

leoegorov commented 4 years ago

The option don't let pages steal the focus on load is helping against keyboard hijacking by websites such as yahoo.com . Pressing unmapped keys like 'e' in default config will not result in that letter being sent to the webpage's search box.

There are however some nasty websites such as yandex.ru/news that capture every input they can get their hands (or event listeners) on. Pressing unmapped keys like 'e' and even some mapped keys like 'c' in default config will result in that letter being stolen and sent to the webpage's search box.

It would be nice if vimium had an option to block that behavior in all cases except when insert mode is activated. Something like don't let pages steal the focus except when insert mode is activated

STEPS TO REPRODUCE

  1. Go to an over-engineered website: https://yandex.ru/news/story/EHkspert_rasskazal_mozhno_li_skryt_dannye_o_geolokacii_na_smartfone--0ca9d02ffd50dd2df5355a65be0321d6?lr=213&lang=ru&persistent_id=94292609&rubric=computers&from=rubric
  2. Press 'v' to enter caret mode ("no usable selection")
  3. Navigate to the beginning of the first paragraph using h,j,k,l
  4. Press 'v' again to get into visual mode
  5. Press 'w' to select the first word and watch as the search box steals your input
gdh1995 commented 4 years ago

In Visual Mode, keys like W should always be consumed by Vimium. And page scripts can only run after Vimium C getting inited, so it's very strange that it can grab the w keys in the 5th step.

I just took a try and didn't reproduce it - Vimium grabbed w and extended the selection area.

Did v in the 4th step really enter Visual Mode?