This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch geckoview-102.3.0esr-12.0-1 in repository tor-browser.
commit a6829d8ca2842dffd63add69db14c1484fd8acbe Author: Neil Deakin neil@mozilla.com AuthorDate: Fri Aug 19 22:15:50 2022 +0000
Bug 1759604, check CanDropLink during the drop event as sites can cancel the dragover event causing the drop event to still fire, r=arai a=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D154896 --- docshell/base/nsDocShellTreeOwner.cpp | 8 +++ dom/events/test/browser.ini | 4 ++ dom/events/test/browser_dragimage.js | 67 ++++++++++++++++++++++ dom/events/test/dragimage.html | 10 ++++ dom/events/test/green.png | Bin 0 -> 255 bytes testing/mochitest/tests/SimpleTest/EventUtils.js | 4 +- toolkit/content/widgets/browser-custom-element.js | 4 ++ 7 files changed, 95 insertions(+), 2 deletions(-)
diff --git a/docshell/base/nsDocShellTreeOwner.cpp b/docshell/base/nsDocShellTreeOwner.cpp index e5787bc423f6b..58a69739b7758 100644 --- a/docshell/base/nsDocShellTreeOwner.cpp +++ b/docshell/base/nsDocShellTreeOwner.cpp @@ -961,6 +961,14 @@ nsDocShellTreeOwner::HandleEvent(Event* aEvent) { } else if (eventType.EqualsLiteral("drop")) { nsIWebNavigation* webnav = static_cast<nsIWebNavigation*>(mWebBrowser);
+ // The page might have cancelled the dragover event itself, so check to + // make sure that the link can be dropped first. + bool canDropLink = false; + handler->CanDropLink(dragEvent, false, &canDropLink); + if (!canDropLink) { + return NS_OK; + } + nsTArray<RefPtr<nsIDroppedLinkItem>> links; if (webnav && NS_SUCCEEDED(handler->DropLinks(dragEvent, true, links))) { if (links.Length() >= 1) { diff --git a/dom/events/test/browser.ini b/dom/events/test/browser.ini index 8d9a7701ae17d..4598bfb71ea15 100644 --- a/dom/events/test/browser.ini +++ b/dom/events/test/browser.ini @@ -9,6 +9,10 @@ support-files = ../../../browser/base/content/test/general/head.js
[browser_bug1539497.js] +[browser_dragimage.js] +support-files = + dragimage.html + green.png [browser_keyboard_event_init_key_event_enabled_in_contentscript.js] support-files = file_keyboard_event_init_key_event_enabled_in_contentscript.html diff --git a/dom/events/test/browser_dragimage.js b/dom/events/test/browser_dragimage.js new file mode 100644 index 0000000000000..4ba9a5d62a949 --- /dev/null +++ b/dom/events/test/browser_dragimage.js @@ -0,0 +1,67 @@ +const TEST_URI = "dragimage.html"; + +// This test checks that dragging an image onto the same document +// does not drop it, even when the page cancels the dragover event. +add_task(async function dragimage_remote_tab() { + var tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + "http://www.example.com/browser/dom/events/test/" + TEST_URI + ); + + let dropHappened = false; + let oldHandler = tab.linkedBrowser.droppedLinkHandler; + tab.linkedBrowser.droppedLinkHandler = () => { + dropHappened = true; + }; + + await SpecialPowers.spawn(tab.linkedBrowser, [], async () => { + let image = content.document.body.firstElementChild; + let target = content.document.body.lastElementChild; + + const EventUtils = ContentTaskUtils.getEventUtils(content); + + await EventUtils.synthesizePlainDragAndDrop({ + srcElement: image, + destElement: target, + srcWindow: content, + destWindow: content, + id: content.windowUtils.DEFAULT_MOUSE_POINTER_ID, + }); + }); + + tab.linkedBrowser.droppedLinkHandler = oldHandler; + + ok(!dropHappened, "drop did not occur"); + + BrowserTestUtils.removeTab(tab); +}); + +// This test checks the same but with an in-process page. +add_task(async function dragimage_local_tab() { + var tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + getRootDirectory(gTestPath) + TEST_URI + ); + + let dropHappened = false; + let oldHandler = tab.linkedBrowser.droppedLinkHandler; + tab.linkedBrowser.droppedLinkHandler = () => { + dropHappened = true; + }; + + let image = tab.linkedBrowser.contentDocument.body.firstElementChild; + let target = tab.linkedBrowser.contentDocument.body.lastElementChild; + + await EventUtils.synthesizePlainDragAndDrop({ + srcElement: image, + destElement: target, + srcWindow: tab.linkedBrowser.contentWindow, + destWindow: tab.linkedBrowser.contentWindow, + }); + + tab.linkedBrowser.droppedLinkHandler = oldHandler; + + ok(!dropHappened, "drop did not occur"); + + BrowserTestUtils.removeTab(tab); +}); diff --git a/dom/events/test/dragimage.html b/dom/events/test/dragimage.html new file mode 100644 index 0000000000000..059b1de90f872 --- /dev/null +++ b/dom/events/test/dragimage.html @@ -0,0 +1,10 @@ +<html> +<head> +<title>Drag Image Test</title> +</head> +<body> +<img src="green.png" width=100 height=100> +<div id='over' style='width: 100px; height: 100px; border: 1px solid black;' + ondragover="event.preventDefault();"></div> +</body> +</html> diff --git a/dom/events/test/green.png b/dom/events/test/green.png new file mode 100644 index 0000000000000..7df25f33bdb26 Binary files /dev/null and b/dom/events/test/green.png differ diff --git a/testing/mochitest/tests/SimpleTest/EventUtils.js b/testing/mochitest/tests/SimpleTest/EventUtils.js index 5a9021fcd46a7..8167456dc6c32 100644 --- a/testing/mochitest/tests/SimpleTest/EventUtils.js +++ b/testing/mochitest/tests/SimpleTest/EventUtils.js @@ -3089,7 +3089,7 @@ async function synthesizePlainDragAndDrop(aParams) { );
try { - _getDOMWindowUtils().disableNonTestMouseEvents(true); + _getDOMWindowUtils(srcWindow).disableNonTestMouseEvents(true);
await new Promise(r => setTimeout(r, 0));
@@ -3414,7 +3414,7 @@ async function synthesizePlainDragAndDrop(aParams) { srcWindow.removeEventListener("dragend", onDragEnd, { capture: true }); } } - _getDOMWindowUtils().disableNonTestMouseEvents(false); + _getDOMWindowUtils(srcWindow).disableNonTestMouseEvents(false); if (logFunc) { logFunc("synthesizePlainDragAndDrop() -- END"); } diff --git a/toolkit/content/widgets/browser-custom-element.js b/toolkit/content/widgets/browser-custom-element.js index dfcbfbf497cc8..1cd33cd0d361e 100644 --- a/toolkit/content/widgets/browser-custom-element.js +++ b/toolkit/content/widgets/browser-custom-element.js @@ -175,6 +175,10 @@
let linkHandler = Services.droppedLinkHandler; try { + if (!linkHandler.canDropLink(event, false)) { + return; + } + // Pass true to prevent the dropping of javascript:/data: URIs var links = linkHandler.dropLinks(event, true); } catch (ex) {