278025 - nsHTMLLinkElement::CreateAndDispatchEvent should call SetTrusted otherwise events *DO* get improperly dispatched untrusted

Status: RESOLVED FIXED

(Core :: DOM: Events, defect)

Description

[timeless]

steps:
1. build mozilla18a5
2. run mozilla
3. attach w/ devenv
4. breakpoint 
      privEvt->SetTrusted(NS_SUCCEEDED(res) && enabled);
in
nsEventStateManager::DispatchNewEvent
condition: !enabled

5. browse the web
6. sanity check stacks

expected results:
only events dispatched from content should appear.

actual results:
system generated events appear.

Comment 1

[timeless]

Attachment: stack showing code path

Comment 2

[Boris Zbarsky [:bzbarsky]]

So the point is, the events <link> elements dispatch on SetDocument() are ending
up untrusted if you document.write the <link> (since there's content JS on the
stack).

We should be setting the trusted flag here after we createEvent, no?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Like so, say

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 173106 [details] [diff] [review]
Like so, say

Yeah, makes sense.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed.