Bug 53424 – Don't manually set user gesture in HTMLAnchorElement's click handle.

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Johnny(Jianning) Ding]

Currently, WebKit manually sets user gesture in HTMLAnchorElement's click handle. (HTMLAnchorElement.cpp, line 555).
There is a FIXME comment in line 554 and says "This seems wrong.  Why are we manufactuing a user gesture?". Yes, current behavior is wrong. With it, people can create custom events to force to open popup windows without real use gesture. See the following code which forces to pop up new window without user gesture. (copy from http://crbug.com/71167)

<A id=test href="javascript:window.open('http://www.google.com','','height=200,width=200')" target=_blank>test</A> 
<SCRIPT> 
oClickEvent = document.createEvent("MouseEvents");
oClickEvent.initEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
document.getElementById("test").dispatchEvent(oClickEvent);
</SCRIPT>

The current behavior was added in r20813<http://trac.webkit.org/changeset/20813>, I don't think we need to keep this logic now.
Will remove the logic of setting user gesture in HTMLAnchorElement's click handle and add a test for regression.

[Johnny(Jianning) Ding]

Created attachment 80729 [details]
patch v1

[WebKit Commit Bot]

Comment on attachment 80729 [details]
patch v1

Clearing flags on attachment: 80729

Committed r77329: <http://trac.webkit.org/changeset/77329>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Chris Evans]

This is also CVE-2011-1194; see https://bugs.webkit.org/show_bug.cgi?id=53244