Bug 350334, Core XBL widgets used in web pages can't listen to their own events, r+sr=jst+sicking

content/xbl/src/nsXBLBinding.cpp

@@ -663,7 +663,8 @@ nsXBLBinding::InstallEventHandlers()
         return;
 
       nsCOMPtr<nsIDOMEventGroup> systemEventGroup;
-
+      PRBool isChromeDoc =
+        nsContentUtils::IsChromeDoc(mBoundElement->GetOwnerDoc());
       nsXBLPrototypeHandler* curr;
       for (curr = handlerChain; curr; curr = curr->GetNextHandler()) {
         // Fetch the event type.
@@ -695,7 +696,9 @@ nsXBLBinding::InstallEventHandlers()
           PRInt32 flags = (curr->GetPhase() == NS_PHASE_CAPTURING) ?
             NS_EVENT_FLAG_CAPTURE : NS_EVENT_FLAG_BUBBLE;
 
-          if (curr->AllowUntrustedEvents()) {
+          PRBool hasAllowUntrustedAttr = curr->HasAllowUntrustedAttr();
+          if ((hasAllowUntrustedAttr && curr->AllowUntrustedEvents()) ||
+              (!hasAllowUntrustedAttr && !isChromeDoc)) {
             flags |= NS_PRIV_EVENT_UNTRUSTED_PERMITTED;
           }
 
@@ -708,6 +711,7 @@ nsXBLBinding::InstallEventHandlers()
       PRInt32 i;
       for (i = 0; i < keyHandlers->Count(); ++i) {
         nsXBLKeyEventHandler* handler = keyHandlers->ObjectAt(i);
+        handler->SetIsBoundToChrome(isChromeDoc);
 
         nsAutoString type;
         handler->GetEventName(type);

content/xbl/src/nsXBLEventHandler.cpp

@@ -48,6 +48,7 @@
 #include "nsGkAtoms.h"
 #include "nsXBLPrototypeHandler.h"
 #include "nsIDOMNSEvent.h"
+#include "nsContentUtils.h"
 
 nsXBLEventHandler::nsXBLEventHandler(nsXBLPrototypeHandler* aHandler)
   : mProtoHandler(aHandler)
@@ -106,7 +107,8 @@ nsXBLKeyEventHandler::nsXBLKeyEventHandler(nsIAtom* aEventType, PRUint8 aPhase,
                                            PRUint8 aType)
   : mEventType(aEventType),
     mPhase(aPhase),
-    mType(aType)
+    mType(aType),
+    mIsBoundToChrome(PR_FALSE)
 {
 }
 
@@ -146,7 +148,10 @@ nsXBLKeyEventHandler::HandleEvent(nsIDOMEvent* aEvent)
   for (i = 0; i < count; ++i) {
     nsXBLPrototypeHandler* handler = NS_STATIC_CAST(nsXBLPrototypeHandler*,
                                                     mProtoHandlers[i]);
-    if ((trustedEvent || handler->AllowUntrustedEvents()) &&
+    PRBool hasAllowUntrustedAttr = handler->HasAllowUntrustedAttr();
+    if ((trustedEvent ||
+        (hasAllowUntrustedAttr && handler->AllowUntrustedEvents()) ||
+        (!hasAllowUntrustedAttr && !mIsBoundToChrome)) &&
         handler->KeyEventMatched(key)) {
       handler->ExecuteHandler(receiver, aEvent);
     }

content/xbl/src/nsXBLEventHandler.h

@@ -115,6 +115,10 @@ public:
     return mType;
   }
 
+  void SetIsBoundToChrome(PRBool aIsBoundToChrome)
+  {
+    mIsBoundToChrome = aIsBoundToChrome;
+  }
 private:
   nsXBLKeyEventHandler();
 
@@ -122,6 +126,7 @@ private:
   nsCOMPtr<nsIAtom> mEventType;
   PRUint8 mPhase;
   PRUint8 mType;
+  PRPackedBool mIsBoundToChrome;
 };
 
 nsresult

content/xbl/src/nsXBLPrototypeBinding.h

@@ -78,8 +78,6 @@ public:
 
   nsresult GetAllowScripts(PRBool* aResult);
 
-  PRBool IsChrome() { return mXBLDocInfoWeak->IsChrome(); }
-
   nsresult BindingAttached(nsIContent* aBoundElement);
   nsresult BindingDetached(nsIContent* aBoundElement);
 

content/xbl/src/nsXBLPrototypeHandler.cpp

@@ -815,10 +815,6 @@ nsXBLPrototypeHandler::ConstructPrototype(nsIContent* aKeyElement,
   else {
     mType |= aCommand ? NS_HANDLER_TYPE_XBL_COMMAND : NS_HANDLER_TYPE_XBL_JS;
     mHandlerText = nsnull;
-
-    if (mPrototypeBinding && !mPrototypeBinding->IsChrome()) {
-      mType |= NS_HANDLER_ALLOW_UNTRUSTED;
-    }
   }
 
   mDetail = -1;
@@ -933,11 +929,12 @@ nsXBLPrototypeHandler::ConstructPrototype(nsIContent* aKeyElement,
   if (aGroup && nsDependentString(aGroup).EqualsLiteral("system"))
     mType |= NS_HANDLER_TYPE_SYSTEM;
 
-  nsAutoString preventDefault(aPreventDefault);
-  if (preventDefault.EqualsLiteral("true"))
+  if (aPreventDefault &&
+      nsDependentString(aPreventDefault).EqualsLiteral("true"))
     mType |= NS_HANDLER_TYPE_PREVENTDEFAULT;
 
   if (aAllowUntrusted) {
+    mType |= NS_HANDLER_HAS_ALLOW_UNTRUSTED_ATTR;
     if (nsDependentString(aAllowUntrusted).EqualsLiteral("true")) {
       mType |= NS_HANDLER_ALLOW_UNTRUSTED;
     } else {

content/xbl/src/nsXBLPrototypeHandler.h

@@ -56,12 +56,13 @@ class nsIDOMEventReceiver;
 class nsIDOM3EventTarget;
 class nsXBLPrototypeBinding;
 
-#define NS_HANDLER_TYPE_XBL_JS          (1 << 0)
-#define NS_HANDLER_TYPE_XBL_COMMAND     (1 << 1)
-#define NS_HANDLER_TYPE_XUL             (1 << 2)
-#define NS_HANDLER_ALLOW_UNTRUSTED      (1 << 5)
-#define NS_HANDLER_TYPE_SYSTEM          (1 << 6)
-#define NS_HANDLER_TYPE_PREVENTDEFAULT  (1 << 7)
+#define NS_HANDLER_TYPE_XBL_JS              (1 << 0)
+#define NS_HANDLER_TYPE_XBL_COMMAND         (1 << 1)
+#define NS_HANDLER_TYPE_XUL                 (1 << 2)
+#define NS_HANDLER_HAS_ALLOW_UNTRUSTED_ATTR (1 << 4)
+#define NS_HANDLER_ALLOW_UNTRUSTED          (1 << 5)
+#define NS_HANDLER_TYPE_SYSTEM              (1 << 6)
+#define NS_HANDLER_TYPE_PREVENTDEFAULT      (1 << 7)
 
 // XXX Use nsIDOMEvent:: codes?
 #define NS_PHASE_CAPTURING          1
@@ -140,6 +141,13 @@ public:
     return mHandler;
   }
 
+  PRBool HasAllowUntrustedAttr()
+  {
+    return (mType & NS_HANDLER_HAS_ALLOW_UNTRUSTED_ATTR) != 0;
+  }
+
+  // This returns a valid value only if HasAllowUntrustedEventsAttr returns
+  // PR_TRUE.
   PRBool AllowUntrustedEvents()
   {
     return (mType & NS_HANDLER_ALLOW_UNTRUSTED) != 0;