Only execute default actions on trusted events.

Source/platform/RuntimeEnabledFeatures.in

 // http://dev.chromium.org/blink/runtime-enabled-features
 //
 // This list is used to generate RuntimeEnabledFeatures.h/cpp which contains
 // a class that stores static enablers for all experimental features.
 //
 // Each feature can be assigned a "status":
 // status=stable -> Enable this in all Blink configurations.  We are committed to these APIs indefinitely.
 // status=experimental -> In-progress features, Web Developers might play with, but are not on by default in stable.
 // status=test -> Enabled in ContentShell for testing, otherwise off.
 // status=deprecated -> Alias for "test", will be removed at some point.
@@ skipping 139 matching lines @@
 Suborigins status=experimental
 TextBlob
 ThreadedParserDataReceiver
 // Many websites disable mouse support when touch APIs are available.  We'd
 // like to enable this always but can't until more websites fix this bug.
 // Chromium sets this conditionally (eg. based on the presence of a
 // touchscreen) in ApplyWebPreferences.
 Touch status=stable
 TouchIconLoading
 TrustedEvents status=experimental
+TrustedEventsDefaultAction

[tkent, 2015/07/16 23:39:45]

Do we need a separated runtime flag?

[dtapuska, 2015/07/17 02:46:10]

Rick wanted two separate flags because this change is a web compatibility
breaking change we might land the TrustedEvents but hold back on the default
action change.

The trusted events change is needed for the password extensions so they properly
deal with injected content from a page.

The idea was the the TrustedEvents experimental flag would be removed once the
extensions developers did a sanity check on their end and security reviewed the
implementation but that we might not do the default action just yet.

The problem I see with this and wanted to discuss with Rick (and value your
opinion) is that if a site wanted to detect that the browser does the default
action on the untrusted events they couldn't just test the Event.isTrusted
property exists. But not sure if someone would take advantage of that or not.
Not sure what they would do in the case of they do detect that it supports
trusted events.

[tkent, 2015/07/17 05:50:41]

ok, I got it.

 UnsafeES3APIs
 UnsandboxedAuxiliary status=experimental
 UserSelectAll status=experimental
 WebAnimationsAPI status=experimental
 WebAnimationsSVG status=experimental
 WebAudio condition=WEB_AUDIO, status=stable
 WebBluetooth
 WebGLDraftExtensions status=experimental
 WebGLImageChromium
 WebVR depends_on=GeometryInterfaces
 WebVTTRegions depends_on=Media, status=experimental
 V8IdleTasks
 XSLT status=stable
 SVG1DOM status=stable
 ScrollCustomization
 ScrollRestoration status=experimental