Only execute default actions on trusted events.

Source/platform/RuntimeEnabledFeatures.in

Index: Source/platform/RuntimeEnabledFeatures.in
diff --git a/Source/platform/RuntimeEnabledFeatures.in b/Source/platform/RuntimeEnabledFeatures.in
index aff89623088f9d7a494e257f5de07127cb369b55..a64e2230ccc1e9f3b4d4f48d6947ac4cceaed812 100644
--- a/Source/platform/RuntimeEnabledFeatures.in
+++ b/Source/platform/RuntimeEnabledFeatures.in
@@ -157,6 +157,7 @@ ThreadedParserDataReceiver
 Touch status=stable
 TouchIconLoading
 TrustedEvents status=experimental
+TrustedEventsDefaultAction

[tkent, 2015/07/16 23:39:45]

Do we need a separated runtime flag?

[dtapuska, 2015/07/17 02:46:10]

Rick wanted two separate flags because this change is a web compatibility
breaking change we might land the TrustedEvents but hold back on the default
action change.

The trusted events change is needed for the password extensions so they properly
deal with injected content from a page.

The idea was the the TrustedEvents experimental flag would be removed once the
extensions developers did a sanity check on their end and security reviewed the
implementation but that we might not do the default action just yet.

The problem I see with this and wanted to discuss with Rick (and value your
opinion) is that if a site wanted to detect that the browser does the default
action on the untrusted events they couldn't just test the Event.isTrusted
property exists. But not sure if someone would take advantage of that or not.
Not sure what they would do in the case of they do detect that it supports
trusted events.

[tkent, 2015/07/17 05:50:41]

ok, I got it.

 UnsafeES3APIs
 UnsandboxedAuxiliary status=experimental
 UserSelectAll status=experimental