1669996 - Selection publicly exposes internal anonymous nodes

Status: NEW

(Core :: DOM: Selection, defect, P3)

Description

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Selecting elements like <details> and <input type=date> exposes internal nodes via anchorNode and focusNode.

1. Open the attachment
2. Try selecting <details> or <input>. It's easier if you start dragging from or finish at the outside of the elements.
3. Call getSelection() from devtools console

Expected: No Restricted nodes
Actual: It happens

Comment 1

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Attachment: bug1669996.html

Comment 2

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Attachment: Bug 1669996 - Rename chromeonly functions as *Internal()

Comment 3

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Attachment: Bug 1669996 - Do not expose chromeonly nodes via Selection API r=emilio

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b85cbc2a47a6
Do not expose chromeonly nodes via Selection API r=emilio

Comment 5

[Narcis Beleuzu [:NarcisB]]

Backed out for mochitest failure on test_queryCaretRect.html

Backout link: https://hg.mozilla.org/integration/autoland/rev/8ac94f155185a1ec04d55dcda8bbe538eb1accbd
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=318460532&repo=autoland&lineNumber=5757

Comment 6

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Attachment: Bug 1669996 - Remove chrome-specific anchorOffset/focusOffset test

Both selectionStart/End and anchorOffset/focusOffset depend on same Selection::GetAnchorFocusRange().

Depends on D93258

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e4b4e21f57de
Do not expose chromeonly nodes via Selection API r=emilio

Comment 8

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Work item: do what Masayuki suggested https://phabricator.services.mozilla.com/D93258#3030710

Comment 9

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/e4b4e21f57de

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/26220 for changes under testing/web-platform/tests

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 12

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

I tested some Shadow DOM and it seems my current patch doesn't cover such case. It still exposes shadow nodes while Blink does not.

Mirko, is Blink behavior in some spec or is our behavior okay?

Comment 13

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Ah okay, it's not.

Comment 14

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

A new case to cover: Selecting text inside ::before by find-in-page exposes internal Restricted node. ("Example 1" in https://w3c.github.io/tr-design/src/readme.html)

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:saschanaz, maybe it's time to close this bug?

Comment 16

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

The issue is still valid, but not the keyword:

Comment 17

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Attachment: WIP: Bug 1669996 - Do not return anonymous nodes from range methods

Comment 18

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Hmm, I wonder I could just return adjusted range objects from Selection methods and cache them to fulfill the same object requirement.

Comment 19

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Not working on this and no plan to return anytime soon...