[Permissions Policy] Fix tab key focus issue in frame with disabled f…

…ocus-without-user-activation According to discussion[1] in webappsec WG and WHATWG, we should allow tab focus from parent frame into its sub frame when permissions policy `focus-without-user-activation` is disabled on the iframe. [1]: w3c/webappsec-permissions-policy#273 (comment) Bug: 371112534 Change-Id: Iaf88e90fd314b7d0e3d44f88dd837476eb3da8d3
web-platform-tests · Dec 17, 2024 · c5273b7 · c5273b7
1 parent 343a084
commit c5273b7
Show file tree

Hide file tree

Showing 3 changed files with 125 additions and 0 deletions.
diff --git a/...hout-user-activation-disabled-by-permissions-policy-cross-origin.tentative.https.sub.html b/...hout-user-activation-disabled-by-permissions-policy-cross-origin.tentative.https.sub.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Focus without user activation container policy test</title>
+
+<body>
+  <script src="./resources/common.js"></script>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/resources/testdriver.js"></script>
+  <script src="/resources/testdriver-vendor.js"></script>
+  <script src="/permissions-policy/resources/permissions-policy.js"></script>
+  <div id="log"></div>
+  <input id="before" />
+
+  <script>
+    var same_origin_src = '/permissions-policy/experimental-features/resources/permissions-policy-focus-without-user-activation-tab-focus.html';
+    var cross_origin_src = 'https://{{domains[www]}}:{{ports[https][0]}}' +
+      same_origin_src;
+    const header = 'permissions policy "focus-without-user-activation" set to "none"';
+
+    const tab_key = "\uE004";
+    const before = document.getElementById("before");
+
+    function subframe_focused() {
+      return new Promise((resolve, reject) => {
+        function tick() {
+          if (document.getElementById("log").innerHTML === "iframe focused") {
+            resolve();
+          } else {
+            requestAnimationFrame(tick.bind(this));
+          }
+        }
+        tick();
+      });
+    }
+
+    window.onmessage = m => {
+      document.getElementById("log").innerHTML = m.data;
+    };
+
+    promise_test(async function (t) {
+      const iframe = createIframe(document.body, {
+        src: cross_origin_src,
+        allow: "focus-without-user-activation none"
+      });
+      await wait_for_load(iframe);
+
+      before.focus();
+      assert_equals(document.activeElement, before, "#before got outer focus");
+
+      await test_driver.send_keys(document.activeElement, tab_key);
+      await subframe_focused();
+      t.add_cleanup(() => {
+        iframe.remove();
+      });
+    }, 'Tab focus from parent frame into cross-origin iframe is allowed with ' + header);
+  </script>
+</body>
diff --git a/...res/focus-without-user-activation-disabled-by-permissions-policy.tentative.https.sub.html b/...res/focus-without-user-activation-disabled-by-permissions-policy.tentative.https.sub.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<title>Focus without user activation container policy test</title>
+
+<body>
+  <script src="./resources/common.js"></script>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/resources/testdriver.js"></script>
+  <script src="/resources/testdriver-vendor.js"></script>
+  <script src="/permissions-policy/resources/permissions-policy.js"></script>
+  <div id="log"></div>
+  <input id="before" />
+
+  <script>
+    var same_origin_src = '/permissions-policy/experimental-features/resources/permissions-policy-focus-without-user-activation-tab-focus.html';
+    var cross_origin_src = 'https://{{domains[www]}}:{{ports[https][0]}}' +
+      same_origin_src;
+    const header = 'permissions policy "focus-without-user-activation" set to "none"';
+
+    const tab_key = "\uE004";
+    const before = document.getElementById("before");
+
+    function subframe_focused() {
+      return new Promise((resolve, reject) => {
+        function tick() {
+          if (document.getElementById("log").innerHTML === "iframe focused") {
+            resolve();
+          } else {
+            requestAnimationFrame(tick.bind(this));
+          }
+        }
+        tick();
+      });
+    }
+
+    window.onmessage = m => {
+      document.getElementById("log").innerHTML = m.data;
+    };
+
+    promise_test(async function (t) {
+      const iframe = createIframe(document.body, {
+        src: same_origin_src,
+        allow: "focus-without-user-activation none"
+      });
+      await wait_for_load(iframe);
+
+      before.focus();
+      assert_equals(document.activeElement, before, "#before got outer focus");
+
+      await test_driver.send_keys(document.activeElement, tab_key);
+      await subframe_focused();
+      t.add_cleanup(() => {
+        iframe.remove();
+      });
+    }, 'Tab focus from parent frame into same-origin iframe is allowed with ' + header);
+  </script>
+</body>
diff --git a/...mental-features/resources/permissions-policy-focus-without-user-activation-tab-focus.html b/...mental-features/resources/permissions-policy-focus-without-user-activation-tab-focus.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+
+<body>
+  <input id="input" type="text">
+</body>
+<script>
+  window.onfocus = function () {
+    document.getElementById("input").focus();
+    parent.postMessage("iframe focused", "*");
+  }
+</script>