Fix #2542, check event.isTrusted around all interactive events

scroll and resize events are skipped, as they have no immediate effect and so synthetic events here won't affect the process
sitehelper is skipped because those events are deliberately synthetic

Add assertIsTrusted globals declaration

addon/webextension/assertIsTrusted.js

@@ -0,0 +1,19 @@
+/** For use with addEventListener, assures that any events have event.isTrusted set to true
+      https://developer.mozilla.org/en-US/docs/Web/API/Event/isTrusted
+    Should be applied *inside* catcher.watchFunction
+*/
+function assertIsTrusted(handlerFunction) {
+  return function (event) {
+    if (! event) {
+      let exc = new Error("assertIsTrusted did not get an event");
+      exc.noPopup = true;
+      throw exc;
+    }
+    if (! event.isTrusted) {
+      let exc = new Error(`Received untrusted event (type: ${event.type})`);
+      exc.noPopup = true;
+      throw exc;
+    }
+    return handlerFunction.call(this, event);
+  };
+}

addon/webextension/background/selectorLoader.js

@@ -6,6 +6,7 @@ window.selectorLoader = (function () {
   // The order is important due to dependencies
   const standardScripts = [
     "catcher.js",
+    "assertIsTrusted.js",
     "background/selectorLoader.js",
     "selector/callBackground.js",
     "selector/util.js"

addon/webextension/onboarding/slides.js

@@ -1,4 +1,4 @@
-/* globals catcher, onboardingHtml, onboardingCss, browser, util, shooter, callBackground */
+/* globals catcher, onboardingHtml, onboardingCss, browser, util, shooter, callBackground, assertIsTrusted */
 
 window.slides = (function () {
   let exports = {};
@@ -117,30 +117,30 @@ window.slides = (function () {
 
   function activateSlide(doc) {
     numberOfSlides = parseInt(doc.querySelector("[data-number-of-slides]").getAttribute("data-number-of-slides"), 10);
-    doc.querySelector("#next").addEventListener("click", watchFunction(() => {
+    doc.querySelector("#next").addEventListener("click", watchFunction(assertIsTrusted(() => {
       shooter.sendEvent("navigate-slide", "next");
       next();
-    }), false);
-    doc.querySelector("#prev").addEventListener("click", watchFunction(() => {
+    })), false);
+    doc.querySelector("#prev").addEventListener("click", watchFunction(assertIsTrusted(() => {
       shooter.sendEvent("navigate-slide", "prev");
       prev();
-    }), false);
+    })), false);
     for (let el of doc.querySelectorAll(".goto-slide")) {
-      el.addEventListener("click", watchFunction((event) => {
+      el.addEventListener("click", watchFunction(assertIsTrusted((event) => {
         shooter.sendEvent("navigate-slide", "goto");
         let el = event.target;
         let index = parseInt(el.getAttribute("data-number"), 10);
         setSlide(index);
-      }), false);
+      })), false);
     }
-    doc.querySelector("#skip").addEventListener("click", watchFunction((event) => {
+    doc.querySelector("#skip").addEventListener("click", watchFunction(assertIsTrusted((event) => {
       shooter.sendEvent("cancel-slides", "skip");
       callbacks.onEnd();
-    }), false);
-    doc.querySelector("#done").addEventListener("click", watchFunction((event) => {
+    })), false);
+    doc.querySelector("#done").addEventListener("click", watchFunction(assertIsTrusted((event) => {
       shooter.sendEvent("finish-slides", "done");
       callbacks.onEnd();
-    }), false);
+    })), false);
     setSlide(1);
   }
 
@@ -165,12 +165,12 @@ window.slides = (function () {
     iframe.style.width = window.innerWidth + "px";
   }
 
-  const onKeyUp = catcher.watchFunction(function (event) {
+  const onKeyUp = catcher.watchFunction(assertIsTrusted(function (event) {
     if ((event.key || event.code) === "Escape") {
       shooter.sendEvent("cancel-slides", "keyboard-escape");
       callbacks.onEnd();
     }
-  });
+  }));
 
   function setSlide(index) {
     if (index < 1) {

addon/webextension/selector/ui.js

@@ -1,5 +1,5 @@
 /* globals window, document, console, browser */
-/* globals util, catcher, inlineSelectionCss, callBackground */
+/* globals util, catcher, inlineSelectionCss, callBackground, assertIsTrusted */
 
 window.ui = (function () { // eslint-disable-line no-unused-vars
   let exports = {};
@@ -260,11 +260,11 @@ window.ui = (function () { // eslint-disable-line no-unused-vars
             overlay.querySelector(".visible").textContent = browser.i18n.getMessage("saveScreenshotVisibleArea");
             overlay.querySelector(".full-page").textContent = browser.i18n.getMessage("saveScreenshotFullPage");
             overlay.querySelector(".myshots-button").addEventListener(
-              "click", watchFunction(standardOverlayCallbacks.onOpenMyShots), false);
+              "click", watchFunction(assertIsTrusted(standardOverlayCallbacks.onOpenMyShots)), false);
             overlay.querySelector(".visible").addEventListener(
-              "click", watchFunction(standardOverlayCallbacks.onClickVisible), false);
+              "click", watchFunction(assertIsTrusted(standardOverlayCallbacks.onClickVisible)), false);
             overlay.querySelector(".full-page").addEventListener(
-              "click", watchFunction(standardOverlayCallbacks.onClickFullPage), false);
+              "click", watchFunction(assertIsTrusted(standardOverlayCallbacks.onClickFullPage)), false);
             resolve();
           });
           document.body.appendChild(this.element);
@@ -376,7 +376,7 @@ window.ui = (function () { // eslint-disable-line no-unused-vars
       if (callbacks !== undefined && callbacks.cancel) {
         // We use onclick here because we don't want addEventListener
         // to add multiple event handlers to the same button
-        this.cancel.onclick = watchFunction(callbacks.cancel);
+        this.cancel.onclick = watchFunction(assertIsTrusted(callbacks.cancel));
         this.cancel.style.display = "";
       } else {
         this.cancel.style.display = "none";
@@ -385,23 +385,23 @@ window.ui = (function () { // eslint-disable-line no-unused-vars
         // We use onclick here because we don't want addEventListener
         // to add multiple event handlers to the same button
         this.save.removeAttribute("disabled");
-        this.save.onclick = watchFunction((e) => {
+        this.save.onclick = watchFunction(assertIsTrusted((e) => {
           this.save.setAttribute("disabled", "true");
           callbacks.save(e);
-        });
+        }));
         this.save.style.display = "";
       } else {
         this.save.style.display = "none";
       }
       if (callbacks !== undefined && callbacks.download) {
         this.download.removeAttribute("disabled");
-        this.download.onclick = watchFunction((e) => {
+        this.download.onclick = watchFunction(assertIsTrusted((e) => {
           this.download.setAttribute("disabled", true);
           callbacks.download(e);
           e.preventDefault();
           e.stopPropagation();
           return false;
-        });
+        }));
         this.download.style.display = "";
       } else {
         this.download.style.display = "none";

addon/webextension/selector/uicontrol.js

@@ -1,5 +1,5 @@
 /* globals console, catcher, util, ui, slides */
-/* globals window, document, location, shooter, callBackground, selectorLoader */
+/* globals window, document, location, shooter, callBackground, selectorLoader, assertIsTrusted */
 
 window.uicontrol = (function () {
   let exports = {};
@@ -365,7 +365,7 @@ window.uicontrol = (function () {
       watchPromise(ui.iframe.display(installHandlersOnDocument, standardOverlayCallbacks).then(() => {
         ui.iframe.usePreSelection();
         ui.Box.remove();
-        const handler = watchFunction(keyupHandler);
+        const handler = watchFunction(assertIsTrusted(keyupHandler));
         document.addEventListener("keyup", handler, false);
         registeredDocumentHandlers.push({name: "keyup", doc: document, handler});
       }));