Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fc1ef83eae10068fe468587d959e868041ddfe03
https://github.com/WebKit/WebKit/commit/fc1ef83eae10068fe468587d959e868041ddfe03
Author: Aditya Keerthi <[email protected]>
Date: 2026-05-20 (Wed, 20 May 2026)
Changed paths:
A
LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted-expected.txt
A LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted.html
M
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-label-element/label-forwarded-click-pointer-properties-expected.txt
M Source/WebCore/dom/Element.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SwitchInputTests.mm
Log Message:
-----------
Haptic feedback for <input type=checkbox switch> can be triggered with a
programmatic click on an associated label
https://bugs.webkit.org/show_bug.cgi?id=309082
rdar://171635705
Reviewed by Lily Spiniolas, Wenson Hsieh, and Abrar Rahman Protyasha.
288403@main ensured that haptic feedback for <input type=checkbox switch>
required
user activation. However, it is also desired that haptics are only triggered for
trusted events. This goal can currently be bypassed by calling `click()` on a
label
associated with the input. The result is that calling `click()` on the label,
immediately following a user gesture, can allow for haptics to be
programmatically
triggered.
The underlying issue is that untrusted click events on label elements become
trusted click events on the associated control. This is because
`Element::dispatchSimulatedClick` unconditionally sets
`SimulatedClickSource::UserAgent`.
While this is desirable for accessibility use cases, it is incorrect when the
underlying event is untrusted.
Fix by specifying `SimulatedClickSource::Bindings` if there is an underlying
event and it is untrusted.
Tests: fast/forms/label/label-click-event-dispatch-untrusted.html
Tools/TestWebKitAPI/Tests/WebKitCocoa/SwitchInputTests.mm
*
LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted-expected.txt:
Added.
* LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted.html: Added.
*
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-label-element/label-forwarded-click-pointer-properties-expected.txt:
* Source/WebCore/dom/Element.cpp:
(WebCore::Element::dispatchSimulatedClick):
If there is an underlying event, the simulated click should be marked as from
"bindings", making it untrusted. This change is not made to `simulateClick`
itself
since that is used by `Element::click()`, which has no underlying event and is
always untrusted.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SwitchInputTests.mm:
(TEST(SwitchInputTests, HapticFeedbackOnClick)):
(TEST(SwitchInputTests, HapticFeedbackRequiresUserGestureAndTrustedEvent)):
(TEST(SwitchInputTests, HapticFeedbackRequiresUserGesture)): Deleted.
Originally-landed-as: 305413.395@safari-7624-branch (2c99c891b64c).
rdar://176067574
Canonical link: https://commits.webkit.org/313638@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
