Why does calling Window.scroll() give a trusted event?

问题

I have a Chrome extension that needs to produce human-like mouse and keyboard behavior (specifically, generate events that have a isTrusted value of true). I can do everything I need except for scrolling with the chrome.debugger APIs.

But it seems that the Window.scroll() method is sufficient for this purpose up to Chrome 52 and Firefox 48.0a1. This can be observed by attaching an event listener to the page as follows:

document.addEventListener("scroll", function (event) { 
    console.log("event trusted? " + event.isTrusted);
});

and then running something like window.scroll(0, 10); in the developer console. This will log event trusted? true to the developer console.

My question is: why is this the case? Shouldn't the isTrusted property be false in this case since the scroll event was clearly generated by a script?

回答1:

This is by specification, per the DOM Living Standard:

NOTE: isTrusted is a convenience that indicates whether an event is dispatched by the user agent (as opposed to using dispatchEvent()). The sole legacy exception is click(), which causes the user agent to dispatch an event whose isTrusted attribute is initialized to false.

Also, in the DOM Level 3 Events Specification:

3.4. Trusted events

Events that are generated by the user agent, either as a result of user interaction, or as a direct result of changes to the DOM, are trusted by the user agent with privileges that are not afforded to events generated by script through the createEvent() method, modified using the initEvent() method, or dispatched via the dispatchEvent() method. The isTrusted attribute of trusted events has a value of true, while untrusted events have a isTrusted attribute value of false.

Thus, isTrusted only reflects if the event has been dispatched or created artificially using createEvent, initEvent, or dispatchEvent. Now, look at the definition of Window.scroll per the CSSOM View Module Editor's Draft:

When the scroll() method is invoked these steps must be run:

[...]

If invoked with two arguments, follow these substeps:

[...]

12. Perform a scroll of the viewport to position, document’s root element as the associated element, if there is one, or null otherwise, and the scroll behavior being the value of the behavior dictionary member of options.

Nowhere in the method is an artificial event created with createEvent, initEvent, or dispatchEvent, thus the value of isTrusted is true. Note that using Window.scroll still triggers the event handler because it integrates with the event loop, and a scroll event is emitted when a viewport or element is scrolled. This does not, however, use createEvent, initEvent, or dispatchEvent.

Using the isTrusted event isn't a sure-fire way of detecting whether a script generated an event. It only detects if an event has been created and dispatched with createEvent, initEvent, or dispatchEvent.

回答2:

It seems that *.scroll or changing the scrollTop property does not construct the event correctly. As you can see in the example the isTrusted is false if I create the event on my own. I think it is a bug in the Engine

"use strict";
var event = new Event('scroll');

//target.addEventListener(type, listener[, options]);
//target.addEventListener(type, listener[, useCapture]);
//target.addEventListener(type, listener[, useCapture, wantsUntrusted  ]); // Gecko/Mozilla only
window.addEventListener('scroll', function(e) {
  console.log(e.isTrusted);
}, false);

console.log('JS engine event:');
window.scroll(10, 10);

setTimeout(function() {
  console.log('Selfmade event:');
  window.dispatchEvent(event);
}, 1000);

setTimeout(function() {
  console.log('Another event triggered by changing the scrollTop property:');
  window.scrollTop = '20px';
}, 2000);

#container {
  width: 100px;
  height: 10000px;
  overflow: scroll;
}

<div id="container">Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata
  sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.
  Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.</div>

来源：https://stackoverflow.com/questions/36656858/why-does-calling-window-scroll-give-a-trusted-event

标签

javascript

javascript-events