Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User Activation: siblings are not processed #9831

Open
CanadaHonk opened this issue Oct 4, 2023 · 7 comments
Open

User Activation: siblings are not processed #9831

CanadaHonk opened this issue Oct 4, 2023 · 7 comments
Labels
interop Implementations are not interoperable with each other topic: user activation

Comments

@CanadaHonk
Copy link
Member

What is the issue with the HTML Standard?

Looking at the same-origin propagation WPT, it has a frame tree like this (simplified):

  • top
    • child one
    • child two

It clicks child two, then expects child one to be isActive and hasBeenActive too.

The spec user activation processing model states:

  1. Let windows be « document's relevant global object ».
  2. Extend windows with the active window of each of document's ancestor navigables.
  3. Extend windows with the active window of each of document's descendant navigables, filtered to include only those navigables whose active document's origin is same origin with document's origin.
  4. For each window in windows, set window's last activation timestamp to the current high resolution time.

It does not state what to do with the elements siblings (seemingly excluding them), yet the WPT expects the sibling of child two (child one) to be activated. Chromium and WebKit appear to follow the WPT behavior and not spec as above, this should probably be corrected in spec by adding same-origin siblings to windows too.

@annevk
Copy link
Member

annevk commented Oct 4, 2023

I wonder if instead of all the tree walks we should then just use an origin map on the agent instead.

@arturjanc @johannhof I guess there's an ABA question here as well, but probably not compatible to enforce it here.

@annevk
Copy link
Member

annevk commented Oct 4, 2023

So I called out this exact concern in #3851 (comment) (and elsewhere in the thread too). @mustaqahmed can you maybe help clarify what happened here? Same-origin sibling documents were indeed not meant to receive activation, but implementations never got updated and the specification didn't get updated either?

@annevk annevk added interop Implementations are not interoperable with each other topic: user activation labels Oct 4, 2023
@CanadaHonk
Copy link
Member Author

Looking at this Chromium bug, it seems they want to remove this behavior from their implementation and consider it a bug. Maybe this idea should just be ditched entirely? I can fix WPTs to match current spec.

@annevk
Copy link
Member

annevk commented Oct 5, 2023

I worry about compat, but it seems reasonable to update WPT given the state of the specification. However, let's give @mustaqahmed at least until next week to chime in here?

@mustaqahmed
Copy link
Contributor

mustaqahmed commented Oct 5, 2023

Thanks for spotting this. Yes we wanted to make Chrome spec complaint but never got a chance to fix it! And then I missed the crack when added the WPT 🤦🏼.

I agree that the compat concerns are real here. I see two ways forward:
A. Update the test to match the spec as @annevk suggested.
B. Rename the test to .tentative and link to this issue.

Let's vote. I am slightly biased towards A.


Closely related: User Activation has been proposed as a focus area for Interop 2024: web-platform-tests/interop#428. We need to find a list of WPTs there, and this one is a clear candidate.

@CanadaHonk
Copy link
Member Author

I agree with A too. I've already updated the test in my Gecko patch implementing the API (was going to wait for this issue), so that'll get merged hopefully in the next week or so if everyone is good with that plan.

moz-wptsync-bot pushed a commit to web-platform-tests/wpt that referenced this issue Oct 6, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: 7c84c5fc7d0002a8bee64ebc66899437638331c6
gecko-reviewers: dom-core, webidl, saschanaz, edgar
moz-wptsync-bot pushed a commit to web-platform-tests/wpt that referenced this issue Oct 6, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: 73919dbff272db85ba6334dca0a9ddfd7f5f039d
gecko-reviewers: dom-core, webidl, saschanaz, edgar
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Oct 7, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Oct 7, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
moz-wptsync-bot pushed a commit to web-platform-tests/wpt that referenced this issue Oct 7, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-reviewers: dom-core, webidl, saschanaz, edgar
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Oct 8, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
moz-wptsync-bot pushed a commit to web-platform-tests/wpt that referenced this issue Oct 8, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-reviewers: dom-core, webidl, saschanaz, edgar
jamienicol pushed a commit to jamienicol/gecko that referenced this issue Oct 9, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
jamienicol pushed a commit to jamienicol/gecko that referenced this issue Oct 9, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
jamienicol pushed a commit to jamienicol/gecko that referenced this issue Oct 9, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
@arturjanc
Copy link

On the narrow, somewhat tangential point about ABA embedding scenarios (same-origin documents with a cross-origin / cross-site ancestor), I think the behavior here is fine from a security/privacy perspective. That is, we are sharing state (activation) across cross-origin ancestors, but this on its own isn't problematic -- the documents can synchronously access and postMessage to each other so this doesn't give them any new capabilities. And because activation is not application state in the same way that e.g. cookies or local storage are, it doesn't seem like the cross-origin ancestor (B) would be able to do anything malicious to leak / affect state from its descendant frame.

Security-wise it would also be okay to propagate the activation to siblings, but I agree that it would be somewhat awkward -- the proposed approach of making the WPT match the spec sounds reasonable to me.

cookiecrook pushed a commit to cookiecrook/wpt that referenced this issue Oct 11, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-reviewers: dom-core, webidl, saschanaz, edgar
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 7c84c5fc7d0002a8bee64ebc66899437638331c6
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 73919dbff272db85ba6334dca0a9ddfd7f5f039d
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 7c84c5fc7d0002a8bee64ebc66899437638331c6
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 73919dbff272db85ba6334dca0a9ddfd7f5f039d
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 7c84c5fc7d0002a8bee64ebc66899437638331c6
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: 73919dbff272db85ba6334dca0a9ddfd7f5f039d
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 13, 2023
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <evilpiesgmail.com>

Differential Revision: https://phabricator.services.mozilla.com/D185348

UltraBlame original commit: fba49989dde6aa32244c622fd43abe19a32128ae
Lightning00Blade pushed a commit to Lightning00Blade/wpt that referenced this issue Dec 11, 2023
Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1791079
gecko-commit: fba49989dde6aa32244c622fd43abe19a32128ae
gecko-reviewers: dom-core, webidl, saschanaz, edgar
surapunoyousei pushed a commit to Floorp-Projects/Floorp that referenced this issue Feb 24, 2024
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
Ponchale added a commit to goastian/midori-desktop that referenced this issue Apr 5, 2024
…az,edgar

Rewrote internal user activation tree (spreading state to other elements)
logic to match HTML spec:
https://html.spec.whatwg.org/multipage/interaction.html#user-activation-processing-model

Added navigator.userActivation API to expose internal user activation.

Also fixed a WPT test to conform to spec (siblings are not activated),
see also spec issue: whatwg/html#9831

Co-authored-by: Tom Schuster <[email protected]>

Differential Revision: https://phabricator.services.mozilla.com/D185348
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
interop Implementations are not interoperable with each other topic: user activation
Development

No branches or pull requests

4 participants