New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 683322 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug
Proj-XR

Blocked on:
issue 686232

Blocking:
issue 779691
issue 679827
issue 670502



Sign in to add a comment

Ensure WebVR controllers and tracking are only exposed to the focused frame

Project Member Reported by mthiesse@chromium.org, Jan 20 2017

Issue description

Exposing pose and other forms of user tracking are a security risk, and so should only be exposed to the focused frame, if possible.

For example, an cross-origin frame (like an ad?) shouldn't be able to listen in to tracking information unless focused.



 
Blocking: 679827
Owner: bajones@chromium.org
Actually I'm not sure if we can even do this at the moment.

We can check the page is focused with m_navigatorVR->page()->focusController().isFocused(), but is there a notion of the frame the script is running in that calls getPose() and others? We'd want to make sure only the script running in the focused frame can get pose data.

Comment 3 by nasko@google.com, Jan 20 2017

Focus is tracked per frame and that information should be available in the C++ world. Don't know how much is exposed to JS.
Blocking: 670502
Components: Privacy
Labels: -OS-Android Proj-VR OS-All

Comment 5 by sko...@chromium.org, Jan 24 2017

Ping Brandon; this is currently a P1 for M57.  Is there an action plan for how to address this?
If Brandon's plate is full, feel free to assign to me, though I'm not very familiar with blink how focus/frames/documents interact.
Owner: mthiesse@chromium.org
My plate is rather full right now. Be my guest.
Not yet sure if this is a bug, or intentional, but currently a page doesn't lose focus in multi-window mode if another activity is focused. Investigating and will file a bug if necessary, but that definitely blocks this from being implemented correctly.
Blockedon: 686232

Comment 10 by nasko@chromium.org, Jan 30 2017

Cc: alex...@chromium.org nasko@chromium.org
Adding alexmos@, who has done work on frame focus across renderer and browser.
PMs, is this still seen as critical for M-57? I would rather just push this back to M-58.
Project Member

Comment 12 by bugdroid1@chromium.org, Feb 6 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/527310a8c856c31a016c8f9c9ddb90a5290aef5b

commit 527310a8c856c31a016c8f9c9ddb90a5290aef5b
Author: mthiesse <mthiesse@chromium.org>
Date: Mon Feb 06 18:31:06 2017

Provide WebVR pose data only to the focused frame.

Testing is tracked in  issue 679827 . For now this is manually tested.

BUG= 683322 ,  686890 

Review-Url: https://codereview.chromium.org/2668003003
Cr-Commit-Position: refs/heads/master@{#448315}

[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/core/page/BUILD.gn
[add] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/core/page/FocusChangedObserver.cpp
[add] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/core/page/FocusChangedObserver.h
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/core/page/FocusController.cpp
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/core/page/FocusController.h
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/NavigatorVR.cpp
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/NavigatorVR.h
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/VRController.cpp
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/VRController.h
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/VRDisplay.cpp
[modify] https://crrev.com/527310a8c856c31a016c8f9c9ddb90a5290aef5b/third_party/WebKit/Source/modules/vr/VRDisplay.h

Is there still more work to do here?
 issue 686232  needs to be fixed before it functions correctly, but nothing more to do for this bug.

Not sure if we want to mark it fixed before it actually works properly though.
Labels: -M-57 M-58
Status: Fixed (was: Assigned)
Marking this as fixed.

Remaining issues are due to the android-specific bug where webpage focus doesn't accurately track input focus. In multi-window mode both windows are considered to have input focus by blink, so one of them effectively at random will get poses.

Also when the app is backgrounded blink doesn't realize it loses input focus, but this is less of an issue because we don't send poses when the app is paused.
Blocking: 779691
Components: Blink>WebXR

Sign in to add a comment