58208 2011-04-10 12:39:24 -0700 hidden attribute on <input type=file /> suppresses the file selection dialog 2012-02-02 00:09:28 -0800 1 1 1 Unclassified WebKit Forms 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 priyajeet.hora rakeshchaitan abarth ap chuck jrb473 priyajeet.hora rakeshchaitan rniwa tkent webkit.review.bot oldest_to_newest 382924 0 88957 priyajeet.hora 2011-04-10 12:39:24 -0700 Created attachment 88957 testcase Downstream bug: http://code.google.com/p/chromium/issues/detail?id=78961 Test case attached. Will show file selection box in firefox, and nothing in webkit. <input id=inp type=file hidden /> <button onclick="document.getElementById('inp').click();">Click me</button> The onclick event is fired though, which can be tested with a simple alert in the input. Looking at the spec, I do read "Elements that are not hidden should not link to or refer to elements that are hidden." http://dev.w3.org/html5/spec/Overview.html#the-hidden-attribute Though unsure if this falls into that category. 483049 1 jrb473 2011-10-13 01:25:21 -0700 As per my observation, in Firefox and IE, we are able to open file system though the "file" element is hidden. In spec, there is written "All HTML elements may have the hidden content attribute set." 483050 2 jrb473 2011-10-13 01:29:39 -0700 As per my observation, in Firefox and IE, we are able to open file system though the "file" element is hidden. In spec, there is written "All HTML elements may have the hidden content attribute set." So in Chrome and Safari, the behavior should be the same as expected. 483368 3 abarth 2011-10-13 12:11:30 -0700 > Looking at the spec, I do read That's conformance information for authors, not for user agents. We probably should match Firefox and IE here. Suppressing the dialog in this case isn't buying us any security. (The control could just as easily be "hidden" by being positioned off-screen.) There's some question about whether the click() method should work at all on this control, but it's behavior shouldn't be different depending on the hidden attribute (unless required by compatibility). 483379 4 rniwa 2011-10-13 12:20:28 -0700 FWIW, we also disable implicit submission when a button is hidden. 483381 5 chuck 2011-10-13 12:21:28 -0700 (In reply to comment #3) > There's some question about whether the click() method should work at all on this control, but it's behavior shouldn't be different depending on the hidden attribute (unless required by compatibility). Mozilla has enabled the .click() method even when the control is otherwise hidden. Using opacity: 0 and setting width/height dimensions are what I usually do for WebKit, though webkit's pseudo-selectors are powerful enough to handle it with more grace. I strongly suggest keeping click, to stay in line with Mozilla. 545818 6 ap 2012-01-30 23:53:58 -0800 Duplicate of bug 53246? 546074 7 124739 rakeshchaitan 2012-01-31 08:16:47 -0800 Created attachment 124739 Proposed patch Patch v1 546077 8 webkit.review.bot 2012-01-31 08:20:37 -0800 Attachment 124739 did not pass style-queue: Failed to run "['Tools/Scripts/update-webkit']" exit_code: 9 Updating OpenSource First, rewinding head to replay your work on top of it... Applying: Fix compilation errors on build-webkit --debug --no-workers on mac. Using index info to reconstruct a base tree... Falling back to patching base and 3-way merge... Auto-merging LayoutTests/ChangeLog CONFLICT (content): Merge conflict in LayoutTests/ChangeLog Auto-merging LayoutTests/platform/qt/Skipped CONFLICT (content): Merge conflict in LayoutTests/platform/qt/Skipped Auto-merging Source/WebCore/ChangeLog CONFLICT (content): Merge conflict in Source/WebCore/ChangeLog Failed to merge in the changes. Patch failed at 0001 Fix compilation errors on build-webkit --debug --no-workers on mac. When you have resolved this problem run "git rebase --continue". If you would prefer to skip this patch, instead run "git rebase --skip". To restore the original branch and stop rebasing run "git rebase --abort". rebase refs/remotes/origin/master: command returned error: 1 Died at Tools/Scripts/update-webkit line 164. If any of these errors are false positives, please file a bug against check-webkit-style. 546385 9 124739 rniwa 2012-01-31 12:42:52 -0800 Comment on attachment 124739 Proposed patch Is it possible to use a similar technique employed in input-file-not-open-without-gesture.html to automatically test this? 546794 10 rakeshchaitan 2012-01-31 21:45:51 -0800 (In reply to comment #9) > (From update of attachment 124739 [details]) > Is it possible to use a similar technique employed in input-file-not-open-without-gesture.html to automatically test this? Thanks for taking time to see this. I think it is not possible to automate this test as file dialog opens only when there is user gesture. In input-file-not-open-without-gesture.html the test is other way round where we don't want file dialog to open when not an user gesture. Please do suggest if there is an way to automate. 546802 11 rniwa 2012-01-31 21:55:29 -0800 (In reply to comment #10) > I think it is not possible to automate this test as file dialog opens only when there is user gesture. In input-file-not-open-without-gesture.html the test is other way round where we don't want file dialog to open when not an user gesture. Please do suggest if there is an way to automate. But you can use eventSender to generate that "gesture", right? 546957 12 rakeshchaitan 2012-02-01 02:49:29 -0800 (In reply to comment #11) > (In reply to comment #10) > > I think it is not possible to automate this test as file dialog opens only when there is user gesture. In input-file-not-open-without-gesture.html the test is other way round where we don't want file dialog to open when not an user gesture. Please do suggest if there is an way to automate. > > But you can use eventSender to generate that "gesture", right? Yes, I tried using eventSender but the problem is that when file dialog shows up the current focus is on file dialog and until the file dialog closes the test won't end. As per my understanding even if we generate user event with eventSender and test that body does not get the click event, we need to close the native file open dialog some how so that test ends(I think sending escape key event through eventSender will not have effect on native dialog). 546960 13 rniwa 2012-02-01 02:53:30 -0800 (In reply to comment #12) > Yes, I tried using eventSender but the problem is that when file dialog shows up > the current focus is on file dialog and until the file dialog closes the test won't end. input-file-not-open-without-gesture.html uses setTimeout for that. It schedules a call to notifyDone before opening the dialog. > As per my understanding even if we generate user event with eventSender and test that body does not get the click event, we need to close the native file open dialog some how so that test ends(I think sending escape key event through eventSender will not have effect on native dialog). So calling notifyDone in setTimeout won't work? 546979 14 rakeshchaitan 2012-02-01 03:29:17 -0800 (In reply to comment #13) > input-file-not-open-without-gesture.html uses setTimeout for that. It schedules a call to notifyDone before opening the dialog. Yes, it does and it works fine as file dialog does not open in this test. input-file-not-open-without-gesture.html does timeout if the click happens through eventSender. > So calling notifyDone in setTimeout won't work? It does not work as file dialog is still open and the call FileInputType::handleDOMActivateEvent is not yet complete, I mean the stack has not yet unwinded. 547107 15 ap 2012-02-01 08:54:31 -0800 The file dialog should not be appearing in DRT and WTR, similarly to how alert() does not start a modal loop. This might require changes in WebCore and test runners. 547652 16 rakeshchaitan 2012-02-01 22:17:22 -0800 (In reply to comment #15) > The file dialog should not be appearing in DRT and WTR, similarly to how alert() does not start a modal loop. This might require changes in WebCore and test runners. What do you suggest, should we go ahead with this patch and for file dialog not be showing up in DRT and WTR we can file a new bug? 547679 17 ap 2012-02-01 23:24:53 -0800 It would certainly be better to make this testable and add a test in the same patch. But I didn't override the r+, meaning that I don't object to landing the patch as is. 547683 18 124739 rniwa 2012-02-01 23:32:08 -0800 Comment on attachment 124739 Proposed patch Given that it's hard to automate the test, it seems fine to land the patch as is. 547701 19 124739 webkit.review.bot 2012-02-02 00:09:23 -0800 Comment on attachment 124739 Proposed patch Clearing flags on attachment: 124739 Committed r106538: <http://trac.webkit.org/changeset/106538> 547702 20 webkit.review.bot 2012-02-02 00:09:28 -0800 All reviewed patches have been landed. Closing bug. 88957 2011-04-10 12:39:24 -0700 2011-04-10 12:39:24 -0700 testcase test.html text/html 246 priyajeet.hora PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KCTxtZXRhIGNoYXJzZXQ9J3V0Zi04JyAvPgoJ PHRpdGxlPnRlc3Q8L3RpdGxlPgo8L2hlYWQ+Cjxib2R5Pgo8aW5wdXQgaWQ9aW5wIHR5cGU9ImZp bGUiIGhpZGRlbiAvPgo8YnV0dG9uIG9uY2xpY2s9ImRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdp bnAnKS5jbGljaygpOyI+Q2xpY2sgbWU8L2J1dHRvbj4KPGRpdiBoaWRkZW4+YWRmc2RmZmQ8L2Rp dj4KPC9ib2R5Pgo8L2h0bWw+ 124739 2012-01-31 08:16:47 -0800 2012-02-02 00:09:23 -0800 Proposed patch bug-58208-20120131214743.patch text/plain 2964 rakeshchaitan U3VidmVyc2lvbiBSZXZpc2lvbjogMTA2MzU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDJhODRjYmM4OWM0ODMw MGRiNGY5OWM1Y2M5Njk1NDhjYzMzZDY0MS4uZTkzY2M3Nzg3ZDZjNWE1MzYzNmI3YTIyMDA3MmQy ZGQwNWM3MDc3ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEyLTAxLTMxICBSYWtl c2ggS04gIDxyYWtlc2gua25AbW90b3JvbGEuY29tPgorCisgICAgICAgIGhpZGRlbiBhdHRyaWJ1 dGUgb24gPGlucHV0IHR5cGU9ZmlsZSAvPiBzdXBwcmVzc2VzIHRoZSBmaWxlIHNlbGVjdGlvbiBk aWFsb2cKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU4 MjA4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2Ug d2FudCB0byBhbGxvdyBvcGVuaW5nIGZpbGUgZGlhbG9nIG9uIGhpZGRlbiBlbGVtZW50IHdoZW4g Y2xpY2soKSBpcyBjYWxsZWQKKyAgICAgICAgb24gdGhlIGVsZW1lbnQuIFRoZSBiZWhhdmlvdXIg aXMgc2ltaWxhciB0byBGaXJlZm94IGFuZCBJRS4KKworICAgICAgICBBZGRlZCBtYW51YWwgdGVz dCBhcyB0aGUgZmlsZSBkaWFsb2cgb3BlbnMgb25seSBvbiB1c2VyIGdlc3R1cmUuCisKKyAgICAg ICAgKiBodG1sL0ZpbGVJbnB1dFR5cGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RmlsZUlucHV0 VHlwZTo6aGFuZGxlRE9NQWN0aXZhdGVFdmVudCk6CisgICAgICAgIFJlbW92ZWQgcmVuZGVyZXIg Y2hlY2sgYXMgaW5wdXQgY2FuIGJlIGhpZGRlbi4KKwogMjAxMi0wMS0zMSAgQWxleGVpIEZpbGlw cG92ICA8YWxleGVpZkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgV2ViIEluc3BlY3Rvcjogc2hv dyBzaXplcyBpbiBieXRlcyBpbnN0ZWFkIG9mIEtCLCBNQiBpbiBoZWFwIHByb2ZpbGVyLgpkaWZm IC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9GaWxlSW5wdXRUeXBlLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvRmlsZUlucHV0VHlwZS5jcHAKaW5kZXggNzZlZmE0MTc4NjY5OGJkNGY2OTU3 OTdjOTVmM2E3MzJkMjMwMjY2Yi4uZWE5YTJlZTY4ZmIyNTQwMDg4MGQ1YTIzZmQ4YjRmYTMzYjk5 YWQ0NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9GaWxlSW5wdXRUeXBlLmNwcAor KysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL0ZpbGVJbnB1dFR5cGUuY3BwCkBAIC0xMzksNyArMTM5 LDcgQEAgU3RyaW5nIEZpbGVJbnB1dFR5cGU6OnZhbHVlTWlzc2luZ1RleHQoKSBjb25zdAogCiB2 b2lkIEZpbGVJbnB1dFR5cGU6OmhhbmRsZURPTUFjdGl2YXRlRXZlbnQoRXZlbnQqIGV2ZW50KQog ewotICAgIGlmIChlbGVtZW50KCktPmRpc2FibGVkKCkgfHwgIWVsZW1lbnQoKS0+cmVuZGVyZXIo KSkKKyAgICBpZiAoZWxlbWVudCgpLT5kaXNhYmxlZCgpKQogICAgICAgICByZXR1cm47CiAKICAg ICBpZiAoIVNjcmlwdENvbnRyb2xsZXI6OnByb2Nlc3NpbmdVc2VyR2VzdHVyZSgpKQpkaWZmIC0t Z2l0IGEvQ2hhbmdlTG9nIGIvQ2hhbmdlTG9nCmluZGV4IDY5MTk3MzQ3YmU0YjUzZGFiMzk0MjVm YzFhZWFjZDhlNjFjNTJjMTkuLjU5ZjMyZDJjNDJhNjEwNjg5Yzk2NzNmNzFkZmYzZDhmOWFlZTNm ZjEgMTAwNjQ0Ci0tLSBhL0NoYW5nZUxvZworKysgYi9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBA QAorMjAxMi0wMS0zMSAgUmFrZXNoIEtOICA8cmFrZXNoLmtuQG1vdG9yb2xhLmNvbT4KKworICAg ICAgICBoaWRkZW4gYXR0cmlidXRlIG9uIDxpbnB1dCB0eXBlPWZpbGUgLz4gc3VwcHJlc3NlcyB0 aGUgZmlsZSBzZWxlY3Rpb24gZGlhbG9nCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD01ODIwOAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogTWFudWFsVGVzdHMvaW5wdXQtZmlsZS1oaWRkZW4tb3Blbi1kaWFs b2ctb24tY2xpY2suaHRtbDogQWRkZWQuCisgICAgICAgIEFkZGluZyBtYW51YWwgdGVzdCBhcyB0 aGUgZmlsZSBkaWFsb2cgb3BlbnMgb25seSBpbiBVc2VyIGdlc3R1cmUuCisKIDIwMTItMDEtMzEg IE5heWFuIEt1bWFyIEsgIDxuYXlhbmtrQG1vdG9yb2xhLmNvbT4KIAogICAgICAgICBbR1RLXSBS ZW1vdmUgVjggY29tcGlsYXRpb24gb3B0aW9uLgpkaWZmIC0tZ2l0IGEvTWFudWFsVGVzdHMvaW5w dXQtZmlsZS1oaWRkZW4tb3Blbi1kaWFsb2ctb24tY2xpY2suaHRtbCBiL01hbnVhbFRlc3RzL2lu cHV0LWZpbGUtaGlkZGVuLW9wZW4tZGlhbG9nLW9uLWNsaWNrLmh0bWwKbmV3IGZpbGUgbW9kZSAx MDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTgw NDJkYjRkM2ViZTQ2MWI0Y2RlYWNhNDdhOTcwYzk0MzE1ZjIxYQotLS0gL2Rldi9udWxsCisrKyBi L01hbnVhbFRlc3RzL2lucHV0LWZpbGUtaGlkZGVuLW9wZW4tZGlhbG9nLW9uLWNsaWNrLmh0bWwK QEAgLTAsMCArMSwxMiBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgorICAgIDxt ZXRhIGNoYXJzZXQ9J3V0Zi04JyAvPgorICAgIDx0aXRsZT5UZXN0IHRoYXQgZmlsZSBkaWFsb2cg b3BlbnMgd2hlbiBjbGljaygpIGlzIGNhbGxlZCA8L3RpdGxlPgorPC9oZWFkPgorPGJvZHk+CitU ZXN0IG1hbnVhbGx5IHRoYXQgd2hlbiB5b3UgY2xpY2sgb24gIkNsaWNrIG1lIiBidXR0b24sIGFu IGZpbGUgb3BlbiBkaWFsb2cgYXBwZWFycy4KKzxpbnB1dCBpZD1maWxlaW5wdXQgdHlwZT0iZmls ZSIgaGlkZGVuIC8+Cis8YnV0dG9uIG9uY2xpY2s9ImRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdm aWxlaW5wdXQnKS5jbGljaygpOyI+Q2xpY2sgbWU8L2J1dHRvbj4KKzwvYm9keT4KKzwvaHRtbD4K