265680 - Websites may turn caret browsing on and off using synthetic events

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Omar Khan]

User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

Malicious (in terms of sticky keys feature, remember?) websites may
turn caret browsing off and on, disorienting a user.
Generates F7 event

Reproducible: Always
Steps to Reproduce:
1. Load test case


Actual Results:  
Caret browsing swicthes.

Expected Results:  
Leave my settings alone.

Comment 1

[Omar Khan]

Attachment: Onload changes caret browsing

Comment 2

[Johnny Stenback (:jst)]

Attachment: Don't enable browse with caret from untrusted events.

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 163099 [details] [diff] [review]
Don't enable browse with caret from untrusted events.

mscott says r+sr=mscott, and asa says a=asa.

Comment 4

[Johnny Stenback (:jst)]

Fixed on aviary, made the exact same change in
xpfe/global/resources/content/bindings/browser.xml too. I'll land this on the
1.7 branch and trunk too...

Comment 5

[sairuh (rarely reading bugmail)]

vrfy'd fixed on linux fc2 with 2004102409-0.9+.

Comment 6

[Johnny Stenback (:jst)]

Fixed on trunk, moving to Browser...

Comment 7

[Johnny Stenback (:jst)]

Attachment: 1.7 branch diff.

Comment 8

[Mike Kaply [:mkaply]]

Comment on attachment 164433 [details] [diff] [review]
1.7 branch diff.

a=mkaply

Comment 9

[Johnny Stenback (:jst)]

Fixed on the 1.7 branch too.