Verify HasUserGesture flag in NavigationHandle which comes from renderer |
|||
Issue descriptionThe flag NavigationHandle::HasUserGesture is transmitted from the renderer process here: https://cs.chromium.org/chromium/src/content/renderer/render_frame_impl.cc?rcl=19a69a1389844f51c474efa446e3f22dd1fb36a8&l=5516 Currently it isn't validated, which means that a compromised renderer could spoof this flag. One idea for validating it would be to test whether a mouse event has been dispatched to that renderer process recently, and if not, clear the flag.
,
Apr 12 2018
,
Apr 12 2018
,
Apr 12 2018
Yes, we are planning for a browser-side user activation detection that would *replace* the ones scattered in renderer side today. This is almost orthogonal to User Activation v2 but fixing it for v1 is not easy so better focus on v2 for this. Part of the problem is defining the set of events that should be treated as user activation (Issue 826293)---this is surprisingly vague today. |
|||
►
Sign in to add a comment |
|||
Comment 1 by dcheng@chromium.org
, Apr 12 2018