[tbb-commits] [tor-browser] 53/73: Bug 1759604, check CanDropLink during the drop event as sites can cancel the dragover event causing the drop event to still fire, r=arai a=RyanVM

gitolite role git at cupani.torproject.org
Wed Sep 21 20:17:46 UTC 2022


This is an automated email from the git hooks/post-receive script.

richard pushed a commit to branch geckoview-102.3.0esr-12.0-1
in repository tor-browser.

commit a6829d8ca2842dffd63add69db14c1484fd8acbe
Author: Neil Deakin <neil at mozilla.com>
AuthorDate: Fri Aug 19 22:15:50 2022 +0000

    Bug 1759604, check CanDropLink during the drop event as sites can cancel the dragover event causing the drop event to still fire, r=arai a=RyanVM
    
    Differential Revision: https://phabricator.services.mozilla.com/D154896
---
 docshell/base/nsDocShellTreeOwner.cpp             |   8 +++
 dom/events/test/browser.ini                       |   4 ++
 dom/events/test/browser_dragimage.js              |  67 ++++++++++++++++++++++
 dom/events/test/dragimage.html                    |  10 ++++
 dom/events/test/green.png                         | Bin 0 -> 255 bytes
 testing/mochitest/tests/SimpleTest/EventUtils.js  |   4 +-
 toolkit/content/widgets/browser-custom-element.js |   4 ++
 7 files changed, 95 insertions(+), 2 deletions(-)

diff --git a/docshell/base/nsDocShellTreeOwner.cpp b/docshell/base/nsDocShellTreeOwner.cpp
index e5787bc423f6b..58a69739b7758 100644
--- a/docshell/base/nsDocShellTreeOwner.cpp
+++ b/docshell/base/nsDocShellTreeOwner.cpp
@@ -961,6 +961,14 @@ nsDocShellTreeOwner::HandleEvent(Event* aEvent) {
   } else if (eventType.EqualsLiteral("drop")) {
     nsIWebNavigation* webnav = static_cast<nsIWebNavigation*>(mWebBrowser);
 
+    // The page might have cancelled the dragover event itself, so check to
+    // make sure that the link can be dropped first.
+    bool canDropLink = false;
+    handler->CanDropLink(dragEvent, false, &canDropLink);
+    if (!canDropLink) {
+      return NS_OK;
+    }
+
     nsTArray<RefPtr<nsIDroppedLinkItem>> links;
     if (webnav && NS_SUCCEEDED(handler->DropLinks(dragEvent, true, links))) {
       if (links.Length() >= 1) {
diff --git a/dom/events/test/browser.ini b/dom/events/test/browser.ini
index 8d9a7701ae17d..4598bfb71ea15 100644
--- a/dom/events/test/browser.ini
+++ b/dom/events/test/browser.ini
@@ -9,6 +9,10 @@ support-files =
   ../../../browser/base/content/test/general/head.js
 
 [browser_bug1539497.js]
+[browser_dragimage.js]
+support-files =
+  dragimage.html
+  green.png
 [browser_keyboard_event_init_key_event_enabled_in_contentscript.js]
 support-files =
   file_keyboard_event_init_key_event_enabled_in_contentscript.html
diff --git a/dom/events/test/browser_dragimage.js b/dom/events/test/browser_dragimage.js
new file mode 100644
index 0000000000000..4ba9a5d62a949
--- /dev/null
+++ b/dom/events/test/browser_dragimage.js
@@ -0,0 +1,67 @@
+const TEST_URI = "dragimage.html";
+
+// This test checks that dragging an image onto the same document
+// does not drop it, even when the page cancels the dragover event.
+add_task(async function dragimage_remote_tab() {
+  var tab = await BrowserTestUtils.openNewForegroundTab(
+    gBrowser,
+    "http://www.example.com/browser/dom/events/test/" + TEST_URI
+  );
+
+  let dropHappened = false;
+  let oldHandler = tab.linkedBrowser.droppedLinkHandler;
+  tab.linkedBrowser.droppedLinkHandler = () => {
+    dropHappened = true;
+  };
+
+  await SpecialPowers.spawn(tab.linkedBrowser, [], async () => {
+    let image = content.document.body.firstElementChild;
+    let target = content.document.body.lastElementChild;
+
+    const EventUtils = ContentTaskUtils.getEventUtils(content);
+
+    await EventUtils.synthesizePlainDragAndDrop({
+      srcElement: image,
+      destElement: target,
+      srcWindow: content,
+      destWindow: content,
+      id: content.windowUtils.DEFAULT_MOUSE_POINTER_ID,
+    });
+  });
+
+  tab.linkedBrowser.droppedLinkHandler = oldHandler;
+
+  ok(!dropHappened, "drop did not occur");
+
+  BrowserTestUtils.removeTab(tab);
+});
+
+// This test checks the same but with an in-process page.
+add_task(async function dragimage_local_tab() {
+  var tab = await BrowserTestUtils.openNewForegroundTab(
+    gBrowser,
+    getRootDirectory(gTestPath) + TEST_URI
+  );
+
+  let dropHappened = false;
+  let oldHandler = tab.linkedBrowser.droppedLinkHandler;
+  tab.linkedBrowser.droppedLinkHandler = () => {
+    dropHappened = true;
+  };
+
+  let image = tab.linkedBrowser.contentDocument.body.firstElementChild;
+  let target = tab.linkedBrowser.contentDocument.body.lastElementChild;
+
+  await EventUtils.synthesizePlainDragAndDrop({
+    srcElement: image,
+    destElement: target,
+    srcWindow: tab.linkedBrowser.contentWindow,
+    destWindow: tab.linkedBrowser.contentWindow,
+  });
+
+  tab.linkedBrowser.droppedLinkHandler = oldHandler;
+
+  ok(!dropHappened, "drop did not occur");
+
+  BrowserTestUtils.removeTab(tab);
+});
diff --git a/dom/events/test/dragimage.html b/dom/events/test/dragimage.html
new file mode 100644
index 0000000000000..059b1de90f872
--- /dev/null
+++ b/dom/events/test/dragimage.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<title>Drag Image Test</title>
+</head>
+<body>
+<img src="green.png" width=100 height=100>
+<div id='over' style='width: 100px; height: 100px; border: 1px solid black;'
+     ondragover="event.preventDefault();"></div>
+</body>
+</html>
diff --git a/dom/events/test/green.png b/dom/events/test/green.png
new file mode 100644
index 0000000000000..7df25f33bdb26
Binary files /dev/null and b/dom/events/test/green.png differ
diff --git a/testing/mochitest/tests/SimpleTest/EventUtils.js b/testing/mochitest/tests/SimpleTest/EventUtils.js
index 5a9021fcd46a7..8167456dc6c32 100644
--- a/testing/mochitest/tests/SimpleTest/EventUtils.js
+++ b/testing/mochitest/tests/SimpleTest/EventUtils.js
@@ -3089,7 +3089,7 @@ async function synthesizePlainDragAndDrop(aParams) {
   );
 
   try {
-    _getDOMWindowUtils().disableNonTestMouseEvents(true);
+    _getDOMWindowUtils(srcWindow).disableNonTestMouseEvents(true);
 
     await new Promise(r => setTimeout(r, 0));
 
@@ -3414,7 +3414,7 @@ async function synthesizePlainDragAndDrop(aParams) {
         srcWindow.removeEventListener("dragend", onDragEnd, { capture: true });
       }
     }
-    _getDOMWindowUtils().disableNonTestMouseEvents(false);
+    _getDOMWindowUtils(srcWindow).disableNonTestMouseEvents(false);
     if (logFunc) {
       logFunc("synthesizePlainDragAndDrop() -- END");
     }
diff --git a/toolkit/content/widgets/browser-custom-element.js b/toolkit/content/widgets/browser-custom-element.js
index dfcbfbf497cc8..1cd33cd0d361e 100644
--- a/toolkit/content/widgets/browser-custom-element.js
+++ b/toolkit/content/widgets/browser-custom-element.js
@@ -175,6 +175,10 @@
 
           let linkHandler = Services.droppedLinkHandler;
           try {
+            if (!linkHandler.canDropLink(event, false)) {
+              return;
+            }
+
             // Pass true to prevent the dropping of javascript:/data: URIs
             var links = linkHandler.dropLinks(event, true);
           } catch (ex) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the tbb-commits mailing list