Restrict devicemotion and deviceorientation IDL to secure contexts

annevk · annevk · commit 29b34672b901 · 2026-01-08T03:52:59.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=304985 rdar://44804273 Reviewed by Ryosuke Niwa. As of 207177@main these events have been restricted to secure contexts, but the IDL has been available everywhere for no good reason. The ondevicemotion and ondeviceorientation properties were also not enumerable, but should be. As far as I can tell from blame nobody got around to making the change. There's no real reason not to do this. The SecureContext change is manually tested as this can only be tested through WPT and the tests for this feature don't work in WebKit due to missing WebDriver support. Since SecureContext is tested in general and we already have tests that the events don't dispatch in secure contexts this should be sufficient. This matches the specification for these events: https://w3c.github.io/deviceorientation/ Canonical link: https://commits.webkit.org/305266@main
diff --git a/LayoutTests/http/tests/events/device-orientation-motion-enumerable-expected.txt b/LayoutTests/http/tests/events/device-orientation-motion-enumerable-expected.txt
@@ -0,0 +1,11 @@
+Test that ondevicemotion and ondeviceorientation are enumerable.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Object.getOwnPropertyNames(window).includes('ondeviceorientation') is true
+PASS Object.getOwnPropertyNames(window).includes('ondevicemotion') is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/http/tests/events/device-orientation-motion-enumerable.html b/LayoutTests/http/tests/events/device-orientation-motion-enumerable.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<script src="/js-test-resources/js-test.js"></script>
+<script>
+description("Test that ondevicemotion and ondeviceorientation are enumerable.");
+
+shouldBeTrue("Object.getOwnPropertyNames(window).includes('ondeviceorientation')");
+shouldBeTrue("Object.getOwnPropertyNames(window).includes('ondevicemotion')");
+</script>
diff --git a/LayoutTests/platform/glib/http/tests/events/device-orientation-motion-enumerable-expected.txt b/LayoutTests/platform/glib/http/tests/events/device-orientation-motion-enumerable-expected.txt
@@ -0,0 +1,12 @@
+Test that ondevicemotion and ondeviceorientation are enumerable.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+FAIL Object.getOwnPropertyNames(window).includes('ondeviceorientation') should be true. Was false.
+FAIL Object.getOwnPropertyNames(window).includes('ondevicemotion') should be true. Was false.
+PASS successfullyParsed is true
+Some tests failed.
+
+TEST COMPLETE
+
diff --git a/Source/WebCore/bindings/js/WebCoreBuiltinNames.h b/Source/WebCore/bindings/js/WebCoreBuiltinNames.h
@@ -191,6 +191,8 @@ namespace WebCore {
     macro(DecompressionStreamTransform) \
     macro(DelayNode) \
     macro(DeprecationReportBody) \
+    macro(DeviceMotionEvent) \
+    macro(DeviceOrientationEvent) \
     macro(DigitalCredential) \
     macro(DocumentTimeline) \
     macro(DynamicsCompressorNode) \
@@ -671,6 +673,8 @@ namespace WebCore {
     macro(onbeforematch) \
     macro(oncommand) \
     macro(oncookiechange) \
+    macro(ondevicemotion) \
+    macro(ondeviceorientation) \
     macro(onnotificationclick) \
     macro(onnotificationclose) \
     macro(onpush) \
diff --git a/Source/WebCore/dom/DeviceMotionEvent.idl b/Source/WebCore/dom/DeviceMotionEvent.idl
@@ -25,7 +25,8 @@
 
 [
     Conditional=DEVICE_ORIENTATION,
-    Exposed=Window
+    Exposed=Window,
+    SecureContext
 ] interface DeviceMotionEvent : Event {
     readonly attribute Acceleration? acceleration;
     readonly attribute Acceleration? accelerationIncludingGravity;
diff --git a/Source/WebCore/dom/DeviceOrientationEvent.idl b/Source/WebCore/dom/DeviceOrientationEvent.idl
@@ -25,7 +25,8 @@
 
 [
     Conditional=DEVICE_ORIENTATION,
-    Exposed=Window
+    Exposed=Window,
+    SecureContext
 ] interface DeviceOrientationEvent : Event {
     readonly attribute unrestricted double? alpha;
     readonly attribute unrestricted double? beta;
diff --git a/Source/WebCore/page/DOMWindow+DeviceMotion.idl b/Source/WebCore/page/DOMWindow+DeviceMotion.idl
@@ -27,7 +27,5 @@
 [
     Conditional=DEVICE_ORIENTATION
 ] partial interface DOMWindow {
-    // FIXME: 'ondevicemotion' should be enumerable.
-    // FIXME: 'ondevicemotion' should be [SecureContext].
-    [NotEnumerable] attribute EventHandler ondevicemotion;
+    [SecureContext] attribute EventHandler ondevicemotion;
 };
diff --git a/Source/WebCore/page/DOMWindow+DeviceOrientation.idl b/Source/WebCore/page/DOMWindow+DeviceOrientation.idl
@@ -27,7 +27,5 @@
 [
     Conditional=DEVICE_ORIENTATION
 ] partial interface DOMWindow {
-    // FIXME: 'ondeviceorientation' should be enumerable.
-    // FIXME: 'ondeviceorientation' should be [SecureContext].
-    [NotEnumerable] attribute EventHandler ondeviceorientation;
+    [SecureContext] attribute EventHandler ondeviceorientation;
 };

Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,8 @@`
`25`	`25`
`26`	`26`	`[`
`27`	`27`	`Conditional=DEVICE_ORIENTATION,`
`28`		`- Exposed=Window`
	`28`	`+ Exposed=Window,`
	`29`	`+ SecureContext`
`29`	`30`	`] interface DeviceMotionEvent : Event {`
`30`	`31`	`readonly attribute Acceleration? acceleration;`
`31`	`32`	`readonly attribute Acceleration? accelerationIncludingGravity;`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,5 @@`
`27`	`27`	`[`
`28`	`28`	`Conditional=DEVICE_ORIENTATION`
`29`	`29`	`] partial interface DOMWindow {`
`30`		`- // FIXME: 'ondevicemotion' should be enumerable.`
`31`		`- // FIXME: 'ondevicemotion' should be [SecureContext].`
`32`		`- [NotEnumerable] attribute EventHandler ondevicemotion;`
	`30`	`+ [SecureContext] attribute EventHandler ondevicemotion;`
`33`	`31`	`};`