Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Spec for window.fence.notifyEvent and onfencedtreeclick #156

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Spec for window.fence.notifyEvent and onfencedtreeclick #156

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c58beb7
Spec for window.fence.notifyEvent and onfencedtreeclick
VergeA Apr 26, 2024
c28cd2c
Condense SecurityError section
VergeA Apr 26, 2024
f4fee50
Address comments from domfarolino
VergeA May 1, 2024
32020e4
Address r2 of comments from domfarolino
VergeA May 6, 2024
2701c71
Address r3 of comments
VergeA May 9, 2024
b27037e
Merge branch 'master' of github.com:VergeA/fenced-frame into spec
VergeA Sep 30, 2024
43cf06b
Address latest comments
VergeA Oct 4, 2024
665404a
Apply user activation to parent
VergeA Oct 4, 2024
ef24bd3
Address more comments
VergeA Oct 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 114 additions & 0 deletions spec.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
text: dom interface; url: concept-element-dom
text: accessibility considerations; url: concept-element-accessibility-considerations
text: represents; url: represents
text: event handler content attributes which may be specified on any HTML element; url: global-attributes:event-handler-content-attributes
urlPrefix: common-dom-interfaces.html
text: reflect; url: reflect
urlPrefix: embedder-content-other.html
Expand Down Expand Up @@ -191,6 +192,8 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
for: environment
text: target browsing context; url: concept-environment-target-browsing-context
text: navigation and traversal task source
text: event handlers on elements, document objects, and window objects; url: event-handlers-on-elements,-document-objects,-and-window-objects
text: idl definitions; url: idl-definitions
urlPrefix: document-sequences.html
for: browsing context
text: active document; url: active-document
Expand Down Expand Up @@ -357,6 +360,14 @@ dl, dd {
background: white;
border: solid #D50606;
}

/* Table styling definitions from https://resources.whatwg.org/standard.css */
table { border-collapse: collapse; border-style: hidden hidden none hidden; margin: 1.25em 0; }
table thead, table tbody { border-bottom: solid; }
table tbody th { text-align: left; }
table tbody th:first-child { border-left: solid; }
table td, table th { border-left: solid; border-right: solid; border-bottom: solid thin; vertical-align: top; padding: 0.2em; }

</style>

<script src="https://resources.whatwg.org/file-issue.js" async></script>
Expand Down Expand Up @@ -1633,6 +1644,7 @@ Several APIs specific to fenced frames are defined on the {{Fence}} interface.
undefined reportEvent(optional ReportEventType event = {});
undefined setReportEventDataForAutomaticBeacons(optional FenceEvent event = {});
sequence&lt;FencedFrameConfig&gt; getNestedConfigs();
undefined notifyEvent(Event event);
};
</pre>

Expand Down Expand Up @@ -1819,6 +1831,47 @@ Several APIs specific to fenced frames are defined on the {{Fence}} interface.
</wpt>
</div>

<div algorithm>
The <dfn method for=Fence>notifyEvent(|event|)</dfn> method steps are:

1. If [=this=]'s {{Document}} is not [=Document/fully active=], then return.

1. Let |navigable| be [=this=]'s [=relevant global object=]'s [=Window/navigable=].

1. If any of the following conditions are met, throw a {{SecurityError}} {{DOMException}}:

* |navigable| is not a [=fenced navigable container/fenced navigable=];
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When is this hit? In an iframe inside of a fenced frame?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are only exposing this interface in fenced frame root documents, and IIUC URN iframes expose window.fence as well, so we shouldn't allow notifyEvent there.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK so this will throw a security error for both URN iframes, as well as iframes nested within fenced frames, right? And that's the intention?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are only exposing this interface in fenced frame root documents

Actually, this isn't true right? @blu25 mentioned that cross-origin iframes inside a fenced frame get access to window.fence. Is that true, and if so does it change the calculus here at all?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"This interface" is referring to fence.notifyEvent() specifically.

cross-origin iframes inside a fenced frame get access to window.fence. Is that true, and if so does it change the calculus here at all?

Step 4 of the create browsing context patch is the piece that has subframes inherit their creator's fenced frame config instance, which is then detected by the fence getter and ultimately lets subframes call window.fence. I don't think that fact changes the calculus of this algorithm, since we only want fenced frame roots to be able to call this method, which is what's currently happening.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, +1 to everything Liam said (sorry, I now realize my wording was a bit confusing).


* |event|'s {{Event/isTrusted}} is false;

* |event|'s [=Event/dispatch flag=] is unset;

* |event|'s {{Event/type}} is not "<code>click</code>"

1. If [=this=]'s [=relevant global object=] does not have [=transient activation=], then return.

1. [=Consume user activation=] for [=this=]'s [=relevant global object=].

1. Let |parentNavigable| be |navigable|'s [=navigable/unfenced parent=].

1. [=Queue a global task=] on the [=DOM manipulation task source=] given |parentNavigable|'s
[=navigable/active window=] to run these steps:

1. Perform the [=activation notification=] steps.

1. [=Fire an event=] named "<code>[=fencedtreeclick=]</code>" at |navigable|'s
[=fenced navigable container=]. Initialize the event's {{Event/bubbles}} and {{Event/cancelable}} attributes to `true`. When running the
<a href="https://dom.spec.whatwg.org/#inner-event-creation-steps">inner event creation steps</a>, set the <var ignore=''>time</var> to an [=implementation-defined=] value that is consistent across all invocations of this method.

<wpt>
/fenced-frame/notify-event-iframe.https.html
/fenced-frame/notify-event-invalid.https.html
/fenced-frame/notify-event-nested-fenced-frames.https.html
/fenced-frame/notify-event-success.https.html
/fenced-frame/notify-event-transient-user-activation.https.html
</wpt>
</div>

<h3 id=new-request-destination>New [=request=] [=request/destination=]</h3>

The processing model of a <{fencedframe}>'s navigation request deviates from that of the normal
Expand Down Expand Up @@ -2951,6 +3004,67 @@ modified such that the first step of the algorithm that runs when a user-agent c
[=traversable navigable=]'s [=system visibility state=] calls the [=Document/inclusive descendant
navigables=] algorithm with [=inclusive-dn-unfenced|unfenced=] set to true.

<h3 id=events>Events</h3>

<h4 id=onfencedtreeclick-header><code>[=onfencedtreeclick=]</code> event handler</h4>
The table in the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#event-handlers-on-elements,-document-objects,-and-window-objects">
event handlers on elements, Document objects, and Window objects</a> section of [[HTML]] is modified to include a new row.

<table>
<thead>
<tr>
<th>[=Event handler=]</th>
<th>[=Event handler event type=]</th>
</tr>
</thead>
<tbody>
<tr>
<td><dfn><code>onfencedtreeclick</code></dfn></td>
<td><code>[=fencedtreeclick=]</code></td>
</tr>
</tbody>
</table>

The {{GlobalEventHandlers}} interface is modified as follows:

<pre class=idl>
partial interface mixin GlobalEventHandlers {
attribute EventHandler onfencedtreeclick;
};
</pre>

Additionally, the list of [=event handler content attributes which may be specified on any HTML element=]
in [[HTML]] is modified to include a new row:

* [=onfencedtreeclick=]

<h4 id=fencedtreeclick-header><code>[=fencedtreeclick=]</code> event type</h4>
The <a href="https://html.spec.whatwg.org/C#events-2">Events</a> table in the
<a href="https://html.spec.whatwg.org/multipage/indices.html">Index</a> section of [[HTML]] is
modified to include a new row.

<table>
<thead>
<tr>
<th>Event</th>
<th>Interface</th>
<th>Interesting targets</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><dfn><code>fencedtreeclick</code></dfn></td>
<td>{{Event}}</td>
<td>Elements</td>
<td>
Fired at a <{fencedframe}> element asynchronously after its
[=fenced navigable container/fenced navigable=]'s {{Document}} calls {{Fence/notifyEvent()}}
</td>
</tr>
</tbody>
</table>

<h2 id="interaction-with-other-specs">Interactions with other specifications</h2>

Due to the necessarily cross-cutting nature of the <{fencedframe}> element and its interactions with
Expand Down
Loading