Set relatedtarget for dragleave/enter events

third_party/WebKit/Source/core/input/MouseEventManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/MouseEventManager.h"
 
 #include "core/clipboard/DataObject.h"
 #include "core/clipboard/DataTransfer.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
@@ skipping 875 matching lines @@
   }
 
   return false;
 }
 
 // Returns if we should continue "default processing", i.e., whether
 // eventhandler canceled.
 WebInputEventResult MouseEventManager::DispatchDragSrcEvent(
     const AtomicString& event_type,
     const WebMouseEvent& event) {
-  return DispatchDragEvent(event_type, GetDragState().drag_src_.Get(), event,
-                           GetDragState().drag_data_transfer_.Get());
+  return DispatchDragEvent(event_type, GetDragState().drag_src_.Get(), nullptr,
+                           event, GetDragState().drag_data_transfer_.Get());
 }
 
 WebInputEventResult MouseEventManager::DispatchDragEvent(
     const AtomicString& event_type,
     Node* drag_target,
+    Node* related_target,
     const WebMouseEvent& event,
     DataTransfer* data_transfer) {
   FrameView* view = frame_->View();
-
   // FIXME: We might want to dispatch a dragleave even if the view is gone.
   if (!view)
     return WebInputEventResult::kNotHandled;
 
+  // We should be setting relatedTarget correctly following the spec:
+  // https://html.spec.whatwg.org/multipage/interaction.html#dragevent
+  // At the same time this should prevent exposing a node from another document.
+  if (related_target &&
+      related_target->GetDocument() != drag_target->GetDocument())
+    related_target = nullptr;
+
   const bool cancelable = event_type != EventTypeNames::dragleave &&
                           event_type != EventTypeNames::dragend;
 
   IntPoint position = FlooredIntPoint(event.PositionInRootFrame());
   IntPoint movement = FlooredIntPoint(event.MovementInRootFrame());
   DragEvent* me = DragEvent::Create(
       event_type, true, cancelable, frame_->GetDocument()->domWindow(), 0,
       event.PositionInScreen().x, event.PositionInScreen().y, position.X(),
       position.Y(), movement.X(), movement.Y(),
       static_cast<WebInputEvent::Modifiers>(event.GetModifiers()), 0,
       MouseEvent::WebInputEventModifiersToButtons(event.GetModifiers()),
-      nullptr, TimeTicks::FromSeconds(event.TimeStampSeconds()), data_transfer,
+      related_target, TimeTicks::FromSeconds(event.TimeStampSeconds()),
+      data_transfer,
       event.FromTouch() ? MouseEvent::kFromTouch
                         : MouseEvent::kRealOrIndistinguishable);
 
   return EventHandlingUtil::ToWebInputEventResult(
       drag_target->DispatchEvent(me));
 }
 
 void MouseEventManager::ClearDragDataTransfer() {
   if (!frame_->GetPage())
     return;
@@ skipping 99 matching lines @@
 
 void MouseEventManager::SetClickCount(int click_count) {
   click_count_ = click_count;
 }
 
 bool MouseEventManager::MouseDownMayStartDrag() {
   return mouse_down_may_start_drag_;
 }
 
 }  // namespace blink