Add usage counters for secure and insecure use of input type file

Add usage counters for secure and insecure use of input type file

This CL adds usage counters to measure when input form elements with
type "file" are attached to the DOM, and whether it is in a secure or
insecure context. May be useful in the future in determining if it can
be deprecated later on insecure origins.

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=196191

[jww, 2015-05-28 23:26:33]

jww@chromium.org changed reviewers:
+ mkwst@chromium.org

[Mike West, 2015-05-29 05:56:31]

Why would we only count if the element is visible? And when is the count
triggered? Would it catch a hidden element being made visible in reaction to a
user interacting with a page (e.g. click upload button, get a form overlay with
this element inside)?

[jww, 2015-05-29 06:08:33]

I'll look into the details tomorrow, but the summary is this is how all the
other input types are measured (except that I'm splitting by privileged and
unprivileged context).

On Thu, May 28, 2015, 10:56 PM  <mkwst@chromium.org> wrote:

> Why would we only count if the element is visible? And when is the count
> triggered? Would it catch a hidden element being made visible in reaction
> to a
> user interacting with a page (e.g. click upload button, get a form overlay
> with
> this element inside)?
>
> https://codereview.chromium.org/1166473002/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to blink-reviews+unsubscribe@chromium.org.

[Mike West, 2015-05-29 06:31:20]

On 2015/05/29 at 06:08:33, jww wrote:
> I'll look into the details tomorrow

It looks like we poke the counter when attaching the element to the DOM for the
first time (see HTMLInputElement::attach).

> but the summary is this is how all the
> other input types are measured (except that I'm splitting by privileged and
> unprivileged context).

Then maybe we should change all of them?

Basically, I just did too many expense reports yesterday: Concur does exactly
this pattern to attach receipts. I imagine it is at least somewhat widespread,
and I think we'd end up undercounting usage if we gate it on visibility.

[jww, 2015-05-29 17:09:10]

On 2015/05/29 06:31:20, Mike West wrote:
> On 2015/05/29 at 06:08:33, jww wrote:
> > I'll look into the details tomorrow
> 
> It looks like we poke the counter when attaching the element to the DOM for
the
> first time (see HTMLInputElement::attach).
> 
> > but the summary is this is how all the
> > other input types are measured (except that I'm splitting by privileged and
> > unprivileged context).
> 
> Then maybe we should change all of them?
> 
> Basically, I just did too many expense reports yesterday: Concur does exactly
> this pattern to attach receipts. I imagine it is at least somewhat widespread,
> and I think we'd end up undercounting usage if we gate it on visibility.

So your view is that we should not gate this on visibility? I'll upload a new
patch that isn't. I'd rather not change all the others in this CL, though, as it
seems like there would be much broader consequences.

[jww, 2015-05-29 17:16:21]

Changed count from just when visible to always.

[Mike West, 2015-05-30 19:22:28]

LGTM.

[jww, 2015-05-30 19:30:23]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2015-05-30 19:30:30]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1166473002/20001

[commit-bot: I haz the power, 2015-05-30 19:33:02]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-05-30 19:33:03]

Try jobs failed on following builders:
  mac_blink_compile_dbg on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/mac_blink_compile_dbg/bu...)

[jww, 2015-05-30 21:50:24]

The CQ bit was checked by jww@chromium.org

[jww, 2015-05-30 21:50:25]

The patchset sent to the CQ was uploaded after l-g-t-m from mkwst@chromium.org
Link to the patchset: https://codereview.chromium.org/1166473002/#ps40001
(title: "Rebase on ToT")

[commit-bot: I haz the power, 2015-05-30 21:50:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1166473002/40001

[commit-bot: I haz the power, 2015-05-31 00:36:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-05-31 00:36:52]

Try jobs failed on following builders:
  linux_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/linux_blink_rel/builds/6...)

[jww, 2015-05-31 00:48:26]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2015-05-31 00:48:37]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1166473002/40001

[commit-bot: I haz the power, 2015-05-31 03:35:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-05-31 03:35:57]

Try jobs failed on following builders:
  linux_blink_rel on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/linux_blink_rel/builds/6...)

[jww, 2015-05-31 07:33:50]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2015-05-31 07:33:58]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1166473002/40001

[commit-bot: I haz the power, 2015-05-31 08:43:59]

Committed patchset #3 (id:40001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=196191