Stephen A Pohl
ee0fd8bc40
A native file picker now ignores a confirmation that arrives within security.notification_enable_delay (default 500) of the picker being shown, keeping the picker open instead of accepting the selection. This reuses the existing anti-clickjacking delay already applied to security-sensitive notifications rather than adding a dedicated pref. The shared timing lives in nsBaseFilePicker: RecordLastShownTime records when the picker is shown, IsPickerInputProtected says whether the time range is still active, and IsWithinInputProtectionTimeRange holds the timing check so it can be unit-tested. Each platform ignores an early confirmation in its native confirm path: macOS via an NSOpenSavePanelDelegate returning NO from panel:validateURL:error:, Windows via IFileDialogEvents::OnFileOk returning S_FALSE, and GTK by ignoring an early response from the non-portal file chooser. The GTK portal path returns only a final result and is left unchanged. A gtest covers the shared timing check. Differential Revision: https://phabricator.services.mozilla.com/D307024
56 lines
1.9 KiB
C++
56 lines
1.9 KiB
C++
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "gtest/gtest.h"
|
|
#include "mozilla/TimeStamp.h"
|
|
#include "nsBaseFilePicker.h"
|
|
|
|
using mozilla::TimeDuration;
|
|
using mozilla::TimeStamp;
|
|
|
|
// Tests the shared timing check used by every platform's file picker to
|
|
// ignore confirmations that arrive before the input-protection time range has
|
|
// passed.
|
|
|
|
TEST(FilePickerInputProtection, WithinTimeRangeIsProtected)
|
|
{
|
|
TimeStamp show = TimeStamp::Now();
|
|
TimeStamp now = show + TimeDuration::FromMilliseconds(100);
|
|
EXPECT_TRUE(
|
|
nsBaseFilePicker::IsWithinInputProtectionTimeRange(show, now, 500));
|
|
}
|
|
|
|
TEST(FilePickerInputProtection, PastTimeRangeIsNotProtected)
|
|
{
|
|
TimeStamp show = TimeStamp::Now();
|
|
TimeStamp now = show + TimeDuration::FromMilliseconds(600);
|
|
EXPECT_FALSE(
|
|
nsBaseFilePicker::IsWithinInputProtectionTimeRange(show, now, 500));
|
|
}
|
|
|
|
TEST(FilePickerInputProtection, BoundaryIsNotProtected)
|
|
{
|
|
// The check uses "less than", so a confirmation exactly at the end of the
|
|
// time range is accepted.
|
|
TimeStamp show = TimeStamp::Now();
|
|
TimeStamp now = show + TimeDuration::FromMilliseconds(500);
|
|
EXPECT_FALSE(
|
|
nsBaseFilePicker::IsWithinInputProtectionTimeRange(show, now, 500));
|
|
}
|
|
|
|
TEST(FilePickerInputProtection, ZeroProtectionDisablesTimeRange)
|
|
{
|
|
TimeStamp show = TimeStamp::Now();
|
|
TimeStamp now = show + TimeDuration::FromMilliseconds(1);
|
|
EXPECT_FALSE(
|
|
nsBaseFilePicker::IsWithinInputProtectionTimeRange(show, now, 0));
|
|
}
|
|
|
|
TEST(FilePickerInputProtection, NullShowTimeDisablesTimeRange)
|
|
{
|
|
TimeStamp now = TimeStamp::Now();
|
|
EXPECT_FALSE(nsBaseFilePicker::IsWithinInputProtectionTimeRange(TimeStamp(),
|
|
now, 500));
|
|
}
|