Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick 6b66a45021a0 from chromium #34072

Merged
merged 2 commits into from May 5, 2022

Conversation

ppontes
Copy link
Member

@ppontes ppontes commented May 4, 2022

Reland "Fix noopener case for user activation consumption"

This is a reland of e9828a82b5c182dc9a7fb0ae7226c35ba1726e7d

The MSAN error is from checking status before err in
content/renderer/render_view_impl.cc .
https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/b8821495655905086193/overview

The fix is to split the check for err and kIgnore into two checks,
and put the err check before kBlocked.

It is probably possible for the browser to consume user activation
but then eventually mojo returns an error and the renderer doesn't
consume activation, but that seems pretty marginal.

Original change's description:

Fix noopener case for user activation consumption

The flow for user activation consumption in window.open was as follows:

Renderer: ask the browser to create a new window
Browser: consume transient user activation (in the browser, and via RPC
to remote frames only)
Browser: return success for opener, return ignore for noopener
Renderer: consume transient user activation upon success

So in the noopener case, the renderer with the local frame where the
window.open originated didn't have its transient user activation
consumed.

The new behavior is to consume user activation in the calling renderer
whenever it is consumed in the browser. We accomplish this by returning
a distinct value kBlocked to represent failure before the browser
consumes user activation.

Bug: 1264543, 1291210
Change-Id: Iffb6e3fd772bef625d3d28e600e6fb73d70ab29f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3468171
Reviewed-by: Dominic Farolino dom@chromium.org
Reviewed-by: Ken Buchanan kenrb@chromium.org
Reviewed-by: Mustaq Ahmed mustaq@chromium.org
Reviewed-by: Charles Reis creis@chromium.org
Reviewed-by: Jonathan Ross jonross@chromium.org
Reviewed-by: Daniel Cheng dcheng@chromium.org
Commit-Queue: Garrett Tanzer gtanzer@chromium.org
Cr-Commit-Position: refs/heads/main@{#973876}

Bug: 1264543, 1291210
Change-Id: Ie27c4d68db34dfd98adee7cc5c743953dad59834
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3481666
Reviewed-by: Jonathan Ross jonross@chromium.org
Reviewed-by: Daniel Cheng dcheng@chromium.org
Reviewed-by: Mustaq Ahmed mustaq@chromium.org
Reviewed-by: Ken Buchanan kenrb@chromium.org
Reviewed-by: Charles Reis creis@chromium.org
Commit-Queue: Garrett Tanzer gtanzer@chromium.org
Cr-Commit-Position: refs/heads/main@{#976745}

Notes: Backported fix for CVE-2022-1497.

@ppontes ppontes requested review from a team as code owners May 4, 2022 19:19
@ppontes ppontes added 18-x-y backport-check-skip Skip trop's backport validity checking semver/patch backwards-compatible bug fixes labels May 4, 2022
@electron-cation electron-cation bot added new-pr 🌱 PR opened in the last 24 hours and removed new-pr 🌱 PR opened in the last 24 hours labels May 4, 2022
@jkleinsc jkleinsc merged commit 8acf68c into 18-x-y May 5, 2022
@jkleinsc jkleinsc deleted the cherry-pick/18-x-y/chromium/6b66a45021a0 branch May 5, 2022 13:42
@release-clerk
Copy link

release-clerk bot commented May 5, 2022

Release Notes Persisted

Backported fix for CVE-2022-1497.

vikunja-bot pushed a commit to go-vikunja/desktop that referenced this pull request May 11, 2022
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [electron](https://github.com/electron/electron) | devDependencies | patch | [`18.2.0` -> `18.2.2`](https://renovatebot.com/diffs/npm/electron/18.2.0/18.2.2) |

---

### Release Notes

<details>
<summary>electron/electron</summary>

### [`v18.2.2`](https://github.com/electron/electron/releases/v18.2.2)

[Compare Source](electron/electron@v18.2.0...v18.2.2)

### Release Notes for v18.2.2

#### Fixes

-   Fixed a crash on Windows when opening apps in multiple, separate user sessions. [#&#8203;34161](electron/electron#34161) <span style="font-size:small;">(Also in [19](https://github.com/electron/electron/pull/34160))</span>
-   Fixed an OSR crash happening when input select items were rendered. [#&#8203;34092](electron/electron#34092) <span style="font-size:small;">(Also in [17](electron/electron#34091), [19](https://github.com/electron/electron/pull/34093))</span>
-   Fixed an issue where calling `SetLoginItemSettings()` could potentially cause network volumes to be incorrectly mounted. [#&#8203;34106](electron/electron#34106) <span style="font-size:small;">(Also in [17](electron/electron#34107), [19](https://github.com/electron/electron/pull/34108))</span>
-   Fixed crash on startup due to missing gtk symbol on older distros. [#&#8203;34150](electron/electron#34150) <span style="font-size:small;">(Also in [19](https://github.com/electron/electron/pull/34151))</span>

#### Other Changes

-   Backported fix for CVE-2022-1485. [#&#8203;34052](electron/electron#34052)
-   Backported fix for CVE-2022-1497. [#&#8203;34072](electron/electron#34072)

</details>

---

### Configuration

📅 **Schedule**: At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Reviewed-on: https://kolaente.dev/vikunja/desktop/pulls/93
Co-authored-by: renovate <renovatebot@kolaente.de>
Co-committed-by: renovate <renovatebot@kolaente.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
18-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants