Chrome Extension Breaks Other Applications

[scotttb 0]

The Evernote Chrome extension has code that calls "preventDefault" on all untrusted KeyboardEvents that reach the document.

See this relevant snippet of code from common.js in the Chrome extension:

 this.onKeyUp = this.onKeyUp.bind(this), e.addEventListener("keydown", e => (0, u.preventUntrustedEvent)(e, this.onKeyDown)), e.addEventListener("keyup", e => (0, u.preventUntrustedEvent)(e, this.onKeyUp))

I assume this is a security measure to stop a page from being able to script that Evernote extension's overlay with simulated actions. However, there are better ways to validate user input than preventDefault and clobbering all key events that reach the document.

As implemented, this has the side of effect of breaking apps and extensions that depend on the standard event behavior.

I had two customers reaching out to us about this issue in our Chrome extension yesterday so this appears to be a new issue in Evernote.

 

[gazumped 11,663]

Hi.  We're a (mainly) user-supported forum.  If you want to report a possible fault / conflict the only option for non-subscribers is Twitter and @EvernoteHelps.  If your customers are subscribers,  maybe they can forward your comments on to https://help.evernote.com/hc/requests/new