leeguooooo
5a858af93f
A DOM `.click()` is isTrusted:false, which security-sensitive embedded forms reject — Google Payments' enabled `保存` button silently no-op'd, so a cross-origin payment/checkout/KYC form could be read, scrolled, and typed into but never submitted. A coordinate click can't help either: getBoxModel for a sub-frame node returns frame-local coords that don't compose the iframe offset, so it lands wrong (verified — the same-origin probe came back isTrusted:false via the coordinate fallback). Fix: click on an in-iframe ref now focuses the element in its own frame session and dispatches a real Enter (Space for checkbox-like roles) on the page session. Chrome routes the key to the focused element across frames (same mechanism as `type --focused`), and Enter/Space on a focused button/link/checkbox fires a trusted click. Non-activatable roles fall back to DOM .click(). Adds e2e_iframe_button_click_is_trusted (+ fixture): an in-iframe button records event.isTrusted into its own text; the test asserts the ref-click delivers isTrusted:true.
29 lines
667 B
HTML
29 lines
667 B
HTML
<!doctype html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>iframe button probe</title>
|
|
</head>
|
|
<body>
|
|
<h1>iframe button probe</h1>
|
|
<iframe
|
|
id="frame"
|
|
width="320"
|
|
height="140"
|
|
srcdoc="
|
|
<!doctype html>
|
|
<html>
|
|
<body style='margin:24px'>
|
|
<button id='b' style='padding:24px;font-size:22px'>save</button>
|
|
<script>
|
|
document.getElementById('b').addEventListener('click', function (e) {
|
|
this.textContent = 'clicked:' + e.isTrusted;
|
|
});
|
|
</script>
|
|
</body>
|
|
</html>
|
|
"
|
|
></iframe>
|
|
</body>
|
|
</html>
|