#81 Keep reCAPTCHA frames in-app so login checkpoints can verify

[Anonymous]

Originally created by: kristofferR

Problem

Logging in through a Facebook checkpoint that requires reCAPTCHA fails: the "I'm not a robot" verification opens in the default browser, and in-app the spinner runs until a "lost response, please refresh" error. Ref [#78].

Root cause

Carrier's on_navigation policy opens any non-internal http(s) URL in the default browser and cancels it in the webview. That policy was written for top-level link clicks — but wry's WKWebView delegate (decidePolicyForNavigationAction) invokes it for every frame, including iframes, with no isMainFrame check (confirmed in wry 0.55.1 src/wkwebview/navigation.rs; webkit2gtk behaves the same on Linux).

Facebook's login checkpoint embeds reCAPTCHA as an iframe chain: www.fbsbx.com/captcha/recaptcha/iframe/ (already internal) → www.google.com/recaptcha/api2|enterprise/anchor|bframe. The Google frames were classified external, cancelled in-app, and shunted to the default browser — where the verification token has no way to postMessage back to the checkpoint page, so the flow can never complete. (Electron wrappers like Caprine never hit this because will-navigate fires for the main frame only.)

Fix

Add a tightly scoped is_captcha_url() to url_rules.rs: URLs whose path starts with /recaptcha/ on a Google-owned host (reusing the existing is_google_owned_host lookalike-rejecting check) or on recaptcha.net (Google's alternate captcha domain) are now treated as internal, so the captcha frames load in-app.

The set matches what Facebook's own captcha-wrapper CSP permits (frame-src … www.google.com, script-src … /recaptcha/api.js, /recaptcha/enterprise.js). Facebook uses reCAPTCHA Enterprise only for login — no hCaptcha/Arkose hosts needed.

Testing

• New unit tests: anchor/bframe/enterprise/recaptcha.net frames are internal; google.com/search, lookalike hosts (google.evil.com, notrecaptcha.net), and /recaptcha/ paths on arbitrary hosts stay external.
• Full gate: cargo fmt + clippy -D warnings + cargo test --lib (57 pass) + bun run check (38 pass).
• Not reproduced end-to-end: triggering a real Facebook login checkpoint on demand isn't feasible, so verification is by code inspection of the wry source plus the frame-URL research above.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed