Bug 2055750: Only allow specific roles on documents. r=accessibility-platform-reviewers,eeejay

Differential Revision: https://phabricator.services.mozilla.com/D325317

accessible/base/nsAccUtils.h

@@ -314,6 +314,12 @@ class nsAccUtils {
    */
   static bool IsValidDetailsTargetForAnchor(const Accessible* aDetails,
                                             const Accessible* aTarget);
+
+  static bool IsARIARoleAllowedOnContentDoc(role aRole) {
+    // We don't need to allow document because the native role for a document is
+    // already document, so ARIA role="document" is redundant.
+    return aRole == roles::APPLICATION || aRole == roles::DIALOG;
+  }
 };
 
 }  // namespace a11y

accessible/generic/DocAccessible.cpp

@@ -2148,7 +2148,7 @@ bool DocAccessible::UpdateAccessibleOnAttrChange(dom::Element* aElement,
     if (mContent == aElement) {
       SetRoleMapEntryForDoc(aElement);
       if (mIPCDoc) {
-        mIPCDoc->SendRoleChangedEvent(Role(), mRoleMapEntryIndex);
+        mIPCDoc->SendRoleChangedEvent(mRoleMapEntryIndex);
       }
 
       return true;
@@ -2249,7 +2249,7 @@ void DocAccessible::UpdateRootElIfNeeded() {
     mContent = rootEl;
     SetRoleMapEntryForDoc(rootEl);
     if (mIPCDoc) {
-      mIPCDoc->SendRoleChangedEvent(Role(), mRoleMapEntryIndex);
+      mIPCDoc->SendRoleChangedEvent(mRoleMapEntryIndex);
     }
   }
 }
@@ -3203,8 +3203,7 @@ void DocAccessible::ARIAActiveDescendantIDMaybeMoved(
 
 void DocAccessible::SetRoleMapEntryForDoc(dom::Element* aElement) {
   const nsRoleMapEntry* entry = aria::GetRoleMap(aElement);
-  if (!entry || entry->role == roles::APPLICATION ||
-      entry->role == roles::DIALOG ||
+  if (!entry || nsAccUtils::IsARIARoleAllowedOnContentDoc(entry->role) ||
       // Role alert isn't valid on the body element according to the ARIA spec,
       // but it's useful for our UI; e.g. the WebRTC sharing indicator.
       (entry->role == roles::ALERT && !mDocumentNode->IsContentDocument())) {

accessible/ipc/DocAccessibleParent.cpp

@@ -989,7 +989,7 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvTextSelectionChangeEvent(
 }
 
 mozilla::ipc::IPCResult DocAccessibleParent::RecvRoleChangedEvent(
-    const a11y::role& aRole, const uint8_t& aRoleMapEntryIndex) {
+    const uint8_t& aRoleMapEntryIndex) {
   ACQUIRE_ANDROID_LOCK
   if (mShutdown) {
     return IPC_OK();
@@ -999,11 +999,14 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvRoleChangedEvent(
     return IPC_FAIL(this, "Invalid role map entry index");
   }
 
-  mNativeRole = aRole;
+  const nsRoleMapEntry* entry = aria::GetRoleMapFromIndex(aRoleMapEntryIndex);
+  if (entry && !nsAccUtils::IsARIARoleAllowedOnContentDoc(entry->role)) {
+    return IPC_FAIL(this, "Invalid role on document");
+  }
   mRoleMapEntryIndex = aRoleMapEntryIndex;
 
 #ifdef MOZ_WIDGET_COCOA
-  PlatformRoleChangedEvent(this, aRole, aRoleMapEntryIndex);
+  PlatformRoleChangedEvent(this, Role(), aRoleMapEntryIndex);
 #endif
 
   return IPC_OK();

accessible/ipc/DocAccessibleParent.h

@@ -171,7 +171,7 @@ class DocAccessibleParent : public RemoteAccessible,
       const uint64_t& aID, nsTArray<TextRangeData>&& aSelection);
 
   mozilla::ipc::IPCResult RecvRoleChangedEvent(
-      const a11y::role& aRole, const uint8_t& aRoleMapEntryIndex);
+      const uint8_t& aRoleMapEntryIndex);
 
   mozilla::ipc::IPCResult RecvBindChildDoc(
       NotNull<PDocAccessibleParent*> aChildDoc, const uint64_t& aID);

accessible/ipc/PDocAccessible.ipdl

@@ -102,7 +102,7 @@ parent:
   async MutationEvents(MutationEventData[] aData);
   async RequestAckMutationEvents();
   async SelectionEvent(uint64_t aID, uint64_t aWidgetID, uint32_t aType);
-  async RoleChangedEvent(role aRole, uint8_t aRoleMapEntryIndex);
+  async RoleChangedEvent(uint8_t aRoleMapEntryIndex);
   async FocusEvent(uint64_t aID, LayoutDeviceIntRect aCaretRect);
   async ScrollingEvent(uint64_t aID, uint64_t aType,
                        uint32_t aScrollX, uint32_t aScrollY,