#114 Cookie auto-decline can click through 2FA/checkpoint pages

[Anonymous]

Originally created by: kristofferR

onFacebookLoginSurface (inject/src/messenger/features/cookie-consent.ts) arms the auto-decline scanner on any page with a password field — including checkpoint/re-auth/2FA interstitials — and bottomActionRow accepts any two-button row with no cookie-text requirement (primaryScore > 40 || items.length === 2). A 2FA chooser with a Continue/Try-another-way pair can get synthetically clicked within the 60s deadline, silently derailing a login flow. The COOKIE_TEXT_RE/COOKIE_ACTION_RE machinery already exists in login-tidy; requiring cookie-ish text near the candidate row would fence this.

[Anonymous]

Originally posted by: kristofferR

Fixed in [#137]. Cookie auto-decline only runs on the login surface, skips any container holding email/password inputs, and resolves aria-labelledby to its referenced text before matching — so it no longer clicks through 2FA/checkpoint pages.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed