fix(iframe): trusted activation for in-iframe buttons — keyboard, not synthetic click (#39)

A DOM `.click()` is isTrusted:false, which security-sensitive embedded forms reject — Google Payments' enabled `保存` button silently no-op'd, so a cross-origin payment/checkout/KYC form could be read, scrolled, and typed into but never submitted. A coordinate click can't help either: getBoxModel for a sub-frame node returns frame-local coords that don't compose the iframe offset, so it lands wrong (verified — the same-origin probe came back isTrusted:false via the coordinate fallback). Fix: click on an in-iframe ref now focuses the element in its own frame session and dispatches a real Enter (Space for checkbox-like roles) on the page session. Chrome routes the key to the focused element across frames (same mechanism as `type --focused`), and Enter/Space on a focused button/link/checkbox fires a trusted click. Non-activatable roles fall back to DOM .click(). Adds e2e_iframe_button_click_is_trusted (+ fixture): an in-iframe button records event.isTrusted into its own text; the test asserts the ref-click delivers isTrusted:true.
2026-06-17 10:16:15 +09:00
parent 58dc02bfdc
commit 5a858af93f
3 changed files with 189 additions and 10 deletions
@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>iframe button probe</title>
+  </head>
+  <body>
+    <h1>iframe button probe</h1>
+    <iframe
+      id="frame"
+      width="320"
+      height="140"
+      srcdoc="
+        <!doctype html>
+        <html>
+          <body style='margin:24px'>
+            <button id='b' style='padding:24px;font-size:22px'>save</button>
+            <script>
+              document.getElementById('b').addEventListener('click', function (e) {
+                this.textContent = 'clicked:' + e.isTrusted;
+              });
+            </script>
+          </body>
+        </html>
+      "
+    ></iframe>
+  </body>
+</html>