Changeset 57045 in webkit


Ignore:
Timestamp:
Apr 3, 2010 12:05:55 AM (14 years ago)
Author:
abarth@webkit.org
Message:

2010-04-02 Andy Estes <​aestes@apple.com>

Reviewed by Adam Barth.

Tests for ​https://bugs.webkit.org/show_bug.cgi?id=37008.

  • fast/events/popup-allowed-from-gesture-initiated-event-expected.txt: Added.
  • fast/events/popup-allowed-from-gesture-initiated-event.html: Added.
  • fast/events/popup-blocked-from-fake-button-click-expected.txt: Added.
  • fast/events/popup-blocked-from-fake-button-click.html: Added.
  • fast/events/popup-blocked-from-fake-focus-expected.txt: Added.
  • fast/events/popup-blocked-from-fake-focus.html: Added.

2010-04-02 Andy Estes <​aestes@apple.com>

Reviewed by Adam Barth.

The previous mechanism for testing whether an event was due to a user
gesture only checked the event type, not the source of the event. This
allowed scripts to defeat popup blocking by programatically emitting
certain types of events.

Change the user gesture detection to check for a flag that is only set
when the event in question was generated through the platform and not
through the DOM.

​https://bugs.webkit.org/show_bug.cgi?id=37008

Tests: fast/events/popup-allowed-from-gesture-initiated-event.html

fast/events/popup-blocked-from-fake-button-click.html
fast/events/popup-blocked-from-fake-focus.html

  • Android.mk: Add UserGestureIndicator.{cpp, h}.
  • GNUmakefile.am: Same.
  • WebCore.gypi: Same.
  • WebCore.pro: Same.
  • WebCore.vcproj/WebCore.vcproj: Same.
  • WebCore.xcodeproj/project.pbxproj: Same.
  • bindings/v8/ScriptController.cpp: (WebCore::ScriptController::processingUserGesture): Check the value of UserGesureIndicator::processingUserGesture().
  • dom/Document.cpp: (WebCore::Document::createEvent): Remove call to Event::setCreatedByDOM().
  • dom/Event.cpp: (WebCore::Event::Event): Remove initializers for m_createdByDOM. (WebCore::Event::fromUserGesture): Check the value of UserGestureIndicator::processingUserGesture().
  • dom/Event.h: Remove m_createdByDOM.
  • dom/UserGestureIndicator.cpp: Added. (WebCore::UserGestureIndicator::UserGestureIndicator): Save the previous value of s_processingUserGesture before setting it to true. (WebCore::UserGestureIndicator::~UserGestureIndicator): Restore s_processingUserGesture to its previous value.
  • dom/UserGestureIndicator.h: Added. (WebCore::UserGestureIndicator::processingUserGesture): Return the value of s_processingUserGesture.
  • page/EventHandler.cpp: (WebCore::EventHandler::handleMousePressEvent): Instantiate a UserGestureIndicator object on the stack to indicate a user gesture is being processed. (WebCore::EventHandler::handleMouseDoubleClickEvent): Same. (WebCore::EventHandler::handleMouseReleaseEvent): Same. (WebCore::EventHandler::keyEvent): Same. (WebCore::EventHandler::handleTouchEvent): Same.
Location:
trunk
Files:
8 added
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r57044 r57045  
     12010-04-02  Andy Estes  <aestes@apple.com>
     2
     3        Reviewed by Adam Barth.
     4
     5        Tests for https://bugs.webkit.org/show_bug.cgi?id=37008.
     6
     7        * fast/events/popup-allowed-from-gesture-initiated-event-expected.txt: Added.
     8        * fast/events/popup-allowed-from-gesture-initiated-event.html: Added.
     9        * fast/events/popup-blocked-from-fake-button-click-expected.txt: Added.
     10        * fast/events/popup-blocked-from-fake-button-click.html: Added.
     11        * fast/events/popup-blocked-from-fake-focus-expected.txt: Added.
     12        * fast/events/popup-blocked-from-fake-focus.html: Added.
     13
    1142010-04-02  Adam Barth  <abarth@webkit.org>
    215

  • trunk/WebCore/Android.mk

    r56825 r57045  
    174174        dom/UIEvent.cpp \
    175175        dom/UIEventWithKeyState.cpp \
     176        dom/UserGestureIndicator.cpp \
    176177        dom/WebKitAnimationEvent.cpp \
    177178        dom/WebKitTransitionEvent.cpp \

  • trunk/WebCore/ChangeLog

    r57041 r57045  
     12010-04-02  Andy Estes  <aestes@apple.com>
     2
     3        Reviewed by Adam Barth.
     4
     5        The previous mechanism for testing whether an event was due to a user
     6        gesture only checked the event type, not the source of the event.  This
     7        allowed scripts to defeat popup blocking by programatically emitting
     8        certain types of events.
     9
     10        Change the user gesture detection to check for a flag that is only set
     11        when the event in question was generated through the platform and not
     12        through the DOM.
     13
     14        https://bugs.webkit.org/show_bug.cgi?id=37008
     15
     16        Tests: fast/events/popup-allowed-from-gesture-initiated-event.html
     17               fast/events/popup-blocked-from-fake-button-click.html
     18               fast/events/popup-blocked-from-fake-focus.html
     19
     20        * Android.mk: Add UserGestureIndicator.{cpp, h}.
     21        * GNUmakefile.am: Same.
     22        * WebCore.gypi: Same.
     23        * WebCore.pro: Same.
     24        * WebCore.vcproj/WebCore.vcproj: Same.
     25        * WebCore.xcodeproj/project.pbxproj: Same.
     26        * bindings/v8/ScriptController.cpp:
     27        (WebCore::ScriptController::processingUserGesture): Check the value of
     28        UserGesureIndicator::processingUserGesture().
     29        * dom/Document.cpp:
     30        (WebCore::Document::createEvent): Remove call to
     31        Event::setCreatedByDOM().
     32        * dom/Event.cpp:
     33        (WebCore::Event::Event): Remove initializers for m_createdByDOM.
     34        (WebCore::Event::fromUserGesture): Check the value of
     35        UserGestureIndicator::processingUserGesture().
     36        * dom/Event.h: Remove m_createdByDOM.
     37        * dom/UserGestureIndicator.cpp: Added.
     38        (WebCore::UserGestureIndicator::UserGestureIndicator): Save the previous
     39        value of s_processingUserGesture before setting it to true.
     40        (WebCore::UserGestureIndicator::~UserGestureIndicator): Restore
     41        s_processingUserGesture to its previous value.
     42        * dom/UserGestureIndicator.h: Added.
     43        (WebCore::UserGestureIndicator::processingUserGesture): Return the value
     44        of s_processingUserGesture.
     45        * page/EventHandler.cpp:
     46        (WebCore::EventHandler::handleMousePressEvent): Instantiate a
     47        UserGestureIndicator object on the stack to indicate a user gesture is
     48        being processed.
     49        (WebCore::EventHandler::handleMouseDoubleClickEvent): Same.
     50        (WebCore::EventHandler::handleMouseReleaseEvent): Same.
     51        (WebCore::EventHandler::keyEvent): Same.
     52        (WebCore::EventHandler::handleTouchEvent): Same.
     53
    1542010-04-02  Justin Schuh  <jschuh@chromium.org>
    255

  • trunk/WebCore/GNUmakefile.am

    r56991 r57045  
    867867        WebCore/dom/UIEventWithKeyState.cpp \
    868868        WebCore/dom/UIEventWithKeyState.h \
     869        WebCore/dom/UserGestureIndicator.cpp \
     870        WebCore/dom/UserGestureIndicator.h \
    869871        WebCore/dom/WebKitAnimationEvent.cpp \
    870872        WebCore/dom/WebKitAnimationEvent.h \

  • trunk/WebCore/WebCore.gypi

    r57028 r57045  
    12211221            'dom/UIEventWithKeyState.cpp',
    12221222            'dom/UIEventWithKeyState.h',
     1223            'dom/UserGestureIndicator.cpp',
     1224            'dom/UserGestureIndicator.h',
    12231225            'dom/WebKitAnimationEvent.cpp',
    12241226            'dom/WebKitAnimationEvent.h',

  • trunk/WebCore/WebCore.pro

    r56968 r57045  
    539539    dom/UIEvent.cpp \
    540540    dom/UIEventWithKeyState.cpp \
     541    dom/UserGestureIndicator.cpp \
    541542    dom/WebKitAnimationEvent.cpp \
    542543    dom/WebKitTransitionEvent.cpp \
    … …  
    12511252    dom/UIEvent.h \
    12521253    dom/UIEventWithKeyState.h \
     1254    dom/UserGestureIndicator.h \
    12531255    dom/WebKitAnimationEvent.h \
    12541256    dom/WebKitTransitionEvent.h \

  • trunk/WebCore/WebCore.vcproj/WebCore.vcproj

    r56991 r57045  
    2948629486                        </File>
    2948729487                        <File
     29488                                RelativePath="..\dom\UserGestureIndicator.cpp"
     29489                                >
     29490                        </File>
     29491                        <File
     29492                                RelativePath="..\dom\UserGestureIndicator.h"
     29493                                >
     29494                        </File>
     29495                        <File
    2948829496                                RelativePath="..\dom\WebKitAnimationEvent.cpp"
    2948929497                                >

  • trunk/WebCore/WebCore.xcodeproj/project.pbxproj

    r56991 r57045  
    560560                24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
    561561                24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */; settings = {ATTRIBUTES = (); }; };
     562                2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */; };
     563                2542F4DB1166C25A00E89A86 /* UserGestureIndicator.h in Headers */ = {isa = PBXBuildFile; fileRef = 2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */; };
    562564                29A812260FBB9C1D00510293 /* AccessibilityRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */; };
    563565                29A812270FBB9C1D00510293 /* AccessibilityTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */; };
    … …  
    59535955                24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheHost.cpp; sourceTree = "<group>"; };
    59545956                24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplicationCacheHost.h; sourceTree = "<group>"; };
     5957                2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserGestureIndicator.cpp; sourceTree = "<group>"; };
     5958                2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserGestureIndicator.h; sourceTree = "<group>"; };
    59555959                29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityRenderObject.cpp; sourceTree = "<group>"; };
    59565960                29A812090FBB9C1D00510293 /* AccessibilityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTable.cpp; sourceTree = "<group>"; };
    … …  
    1622316227                                93354A3B0B24F8C9003F6DEA /* UIEventWithKeyState.cpp */,
    1622416228                                85031B390A44EFC700F992E0 /* UIEventWithKeyState.h */,
     16229                                2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */,
     16230                                2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */,
    1622516231                                31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */,
    1622616232                                31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */,
    … …  
    1878018786                                8952535311641B3400CABF00 /* FileThread.h in Headers */,
    1878118787                                97C078501165D5BE003A32EF /* SuffixTree.h in Headers */,
     18788                                2542F4DB1166C25A00E89A86 /* UserGestureIndicator.h in Headers */,
    1878218789                        );
    1878318790                        runOnlyForDeploymentPostprocessing = 0;
    … …  
    2099521002                                2E3BBF071162DA1100B9409A /* UUID.cpp in Sources */,
    2099621003                                8952535211641B3400CABF00 /* FileThread.cpp in Sources */,
     21004                                2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */,
    2099721005                        );
    2099821006                        runOnlyForDeploymentPostprocessing = 0;

  • trunk/WebCore/bindings/v8/ScriptController.cpp

    r56825 r57045  
    4848#include "ScriptSourceCode.h"
    4949#include "Settings.h"
     50#include "UserGestureIndicator.h"
    5051#include "V8Binding.h"
    5152#include "V8BindingState.h"
    … …  
    177178    // Note: This is more liberal than Firefox's implementation.
    178179    if (event) {
    179         if (event->createdByDOM())
     180        if (!UserGestureIndicator::processingUserGesture())
    180181            return false;
    181182

  • trunk/WebCore/dom/Document.cpp

    r57012 r57045  
    30623062        event = TouchEvent::create();
    30633063#endif
    3064     if (event) {
    3065         event->setCreatedByDOM(true);
     3064    if (event)
    30663065        return event.release();
    3067     }
     3066
    30683067    ec = NOT_SUPPORTED_ERR;
    30693068    return 0;

  • trunk/WebCore/dom/Event.cpp

    r56445 r57045  
    2525
    2626#include "AtomicString.h"
     27#include "UserGestureIndicator.h"
    2728#include <wtf/CurrentTime.h>
    2829
    … …  
    3738    , m_defaultHandled(false)
    3839    , m_cancelBubble(false)
    39     , m_createdByDOM(false)
    4040    , m_eventPhase(0)
    4141    , m_currentTarget(0)
    … …  
    5353    , m_defaultHandled(false)
    5454    , m_cancelBubble(false)
    55     , m_createdByDOM(false)
    5655    , m_eventPhase(0)
    5756    , m_currentTarget(0)
    … …  
    204203bool Event::fromUserGesture()
    205204{
    206     if (createdByDOM())
     205    if (!UserGestureIndicator::processingUserGesture())
    207206        return false;
    208207

  • trunk/WebCore/dom/Event.h

    r56445 r57045  
    159159        virtual Clipboard* clipboard() const { return 0; }
    160160
    161         bool createdByDOM() const { return m_createdByDOM; }
    162         void setCreatedByDOM(bool createdByDOM) { m_createdByDOM = createdByDOM; }
    163 
    164161    protected:
    165162        Event();
    … …  
    180177        bool m_cancelBubble;
    181178
    182         // Whether this event was created by document.createEvent().
    183         bool m_createdByDOM;
    184 
    185179        unsigned short m_eventPhase;
    186180        EventTarget* m_currentTarget;

  • trunk/WebCore/page/EventHandler.cpp

    r56567 r57045  
    6767#include "Settings.h"
    6868#include "TextEvent.h"
     69#include "UserGestureIndicator.h"
    6970#include "WheelEvent.h"
    7071#include "htmlediting.h" // for comparePositions()
    … …  
    11661167{
    11671168    RefPtr<FrameView> protector(m_frame->view());
    1168 
     1169   
     1170    UserGestureIndicator gestureIndicator;
     1171   
    11691172    cancelFakeMouseMoveEvent();
    11701173    m_mousePressed = true;
    … …  
    12951298{
    12961299    RefPtr<FrameView> protector(m_frame->view());
     1300   
     1301    UserGestureIndicator gestureIndicator;
    12971302
    12981303    // We get this instead of a second mouse-up
    … …  
    14621467{
    14631468    RefPtr<FrameView> protector(m_frame->view());
     1469   
     1470    UserGestureIndicator gestureIndicator;
    14641471
    14651472#if ENABLE(PAN_SCROLLING)
    … …  
    21212128    if (!node)
    21222129        return false;
     2130   
     2131    UserGestureIndicator gestureIndicator;
    21232132
    21242133    if (FrameView* view = m_frame->view())
    … …  
    26882697    const Vector<PlatformTouchPoint>& points = event.touchPoints();
    26892698    AtomicString* eventName = 0;
     2699   
     2700    UserGestureIndicator gestureIndicator;
    26902701
    26912702    for (unsigned i = 0; i < points.size(); ++i) {
Note: See TracChangeset for help on using the changeset viewer.