Closed Bug 1864353 Opened 2 years ago Closed 2 years ago

Require trusted input for invokers

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: lwarlow, Unassigned)

References

(Blocks 1 open bug)

Details

Currently invokers work when the invoking button is triggered progamatically via .click() (or via equivalent activations from keyboard I'm guessing).

This needs changing to require an actual user click as part of the security mitigations of invokers.

Blocks: 1856430
Severity: -- → S3

Closing as wontfix based on https://github.com/openui/open-ui/issues/945#issuecomment-1815229335

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.