New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 817222 link

Starred by 1 user

Issue metadata

Status: Started
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocking:
issue 826702



Sign in to add a comment

focus event's relatedTarget is not adjusted

Project Member Reported by hayato@chromium.org, Feb 28 2018

Issue description

From irc #whatwg channel log.

The test case is here: http://mozilla.pettay.fi/shadow_focus.html

It looks #shadowInput is leaked via focus event's relatedTarget.
 

Comment 1 by hayato@chromium.org, Feb 28 2018

Owner: kochi@chromium.org
Status: Assigned (was: Available)
kochi@,
Could you investigate? Is this a general issue for relatedTarget or specific to focus events?

Comment 2 by kochi@chromium.org, Mar 19 2018

For the given test case, if focus moves from the input field named "shadowInput"
to "lightInput", the focus event on the lightInput event is having the
shadowInput element as an .relatedTarget, accidentally leaking an element
inside (closed) shadow tree.

output on the console:
> Focus event captured in light DOM: [object HTMLInputElement], relatedTarget: shadowInput

For the speccing side has been worked on by @annevk at
https://github.com/whatwg/dom/issues/561
https://github.com/whatwg/dom/pull/585
https://github.com/w3c/web-platform-tests/pull/9919

Comment 3 by kochi@chromium.org, Mar 19 2018

Status: Started (was: Assigned)
TODO for myself: check touch events, add test cases for mouse event and pointer event.

WIP CL is here: https://chromium-review.googlesource.com/c/chromium/src/+/967630

Comment 4 by kochi@chromium.org, Mar 29 2018

Blocking: 826702
Cc: kochi@chromium.org
Owner: rakina@chromium.org
rakina, could you take over these event-related bugs from me?
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 27

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9da0291b54f6071573ff076d771da19a11b17ede

commit 9da0291b54f6071573ff076d771da19a11b17ede
Author: Rakina Zata Amni <rakina@chromium.org>
Date: Thu Sep 27 06:07:49 2018

Use adjusted relatedTarget on WindowEventContext

In event capturing phase, when the event is dispatched on window, the
related target was not set properly (it uses the state of the event
at the target, which means related target is the same as when it was
at the target). This might cause leaks when the event's relatedTarget
is inside a shadow tree. This change makes it so at window context,
the relatedTarget used is the relatedTarget of the last
NodeEventContext.

Bug: 817222
Change-Id: I1edea3977202b0a05e3e8ea46a5b8c1edb4b834d
Reviewed-on: https://chromium-review.googlesource.com/1248244
Reviewed-by: Hayato Ito <hayato@chromium.org>
Commit-Queue: Rakina Zata Amni <rakina@chromium.org>
Cr-Commit-Position: refs/heads/master@{#594606}
[add] https://crrev.com/9da0291b54f6071573ff076d771da19a11b17ede/third_party/WebKit/LayoutTests/external/wpt/dom/events/shadow-relatedTarget.html
[modify] https://crrev.com/9da0291b54f6071573ff076d771da19a11b17ede/third_party/blink/renderer/core/dom/events/window_event_context.cc
[modify] https://crrev.com/9da0291b54f6071573ff076d771da19a11b17ede/third_party/blink/renderer/core/dom/events/window_event_context.h

Sign in to add a comment