mirror of
https://github.com/HeyPuter/firefox.git
synced 2026-11-13 20:14:57 -10:00
David Bokan
5e0c4f121b
Automatic update from web-platform-tests Synthetic gestures only dispatch to visible widget This UAF is caused by a synthetic pointer being routed to browser UI. In this case, it starts dragging a tab which starts a nested message loop Further events and gestures are processed in this nested loop and cleaned up. When the message loop returns the stack contains the cleaned up pointers. Synthetic gestures shouldn't be able to target UI outside the web contents area. The event location is intersected with the web contents' RenderWidget's view bounds to prevent this [1]. However, the bounds will be inaccurate if the widget is in a background tab; it won't receive resizes until it's foregrounded (it's also bad that we can dispatch events to a different tab). This CL fixes the issue by ensuring events are dispatched only to a foregrounded widget. If a synthetic gesture is started while the widget is in a background tab, its start is deferred until it comes into the foreground. If the widget is backgrounded while a gestuere is in progress, the gesture is aborted. Note: we don't do this for DevTools injected events as those skip event routing and go straight to the injecting renderer. The comment in [2] makes me think this is a common use case. [1] https://source.chromium.org/chromium/chromium/src/+/refs/heads/main:content/browser/renderer_host/input/synthetic_gesture_target_base.cc;l=155;drc=ac872e771ce001fef191848bab4167d60dfda403 [2] https://source.chromium.org/chromium/chromium/src/+/refs/heads/main:content/browser/renderer_host/input/synthetic_gesture_target_aura.cc;l=140;drc=ac872e771ce001fef191848bab4167d60dfda403 Bug: 1444597 Change-Id: I2955ce60357f7f03e62f44fd1497bd4ea598f660 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4666793 Reviewed-by: Jonathan Ross <[email protected]> Commit-Queue: David Bokan <[email protected]> Reviewed-by: Mustaq Ahmed <[email protected]> Cr-Commit-Position: refs/heads/main@{#1171732} -- wpt-commits: e16853520ae70ba309108ccff87a7816f74be4dd wpt-pr: 40903
49 lines
1.5 KiB
HTML
49 lines
1.5 KiB
HTML
<!DOCTYPE html>
|
|
<meta charset="utf-8">
|
|
<title>Test for PaymentRequest.show() method - should fail when tab is not visible</title>
|
|
<link rel="help" href="https://w3c.github.io/payment-request/#show-method">
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/resources/testdriver.js"></script>
|
|
<script src="/resources/testdriver-vendor.js"></script>
|
|
<!-- For minimize() -->
|
|
<script src="/page-visibility/resources/window_state_context.js"></script>
|
|
<script>
|
|
'use strict';
|
|
|
|
promise_test(async t => {
|
|
const {minimize, restore} = window_state_context(t);
|
|
|
|
const request = new PaymentRequest([
|
|
{
|
|
supportedMethods: "https://apple.com/apple-pay",
|
|
data: {
|
|
version: 3,
|
|
merchantIdentifier: "merchant.com.example",
|
|
countryCode: "US",
|
|
merchantCapabilities: ["supports3DS"],
|
|
supportedNetworks: ["visa"],
|
|
},
|
|
},
|
|
], {
|
|
total: {
|
|
label: "Total",
|
|
amount: {
|
|
currency: "USD",
|
|
value: "1.00",
|
|
},
|
|
}
|
|
});
|
|
|
|
// `bless` simulates a click so it must happen before minimizing the window.
|
|
await test_driver.bless('user activation');
|
|
|
|
// Before we trigger the Payment Request, minimize the window. This should
|
|
// cause the show() call to be rejected.
|
|
await minimize();
|
|
assert_equals(document.hidden, true);
|
|
|
|
return promise_rejects_dom(t, "AbortError", request.show());
|
|
}, 'PaymentRequest.show() cannot be triggered from a hidden context');
|
|
</script>
|