fix(core): prevent handling of not trusted touch events

fixes #4164
framework7io · Apr 14, 2023 · 3ea9ac5 · 3ea9ac5
1 parent 411bfce
commit 3ea9ac5
Show file tree

Hide file tree

Showing 7 changed files with 26 additions and 15 deletions.
diff --git a/src/core/components/calendar/calendar-class.js b/src/core/components/calendar/calendar-class.js
@@ -168,7 +168,7 @@ class Calendar extends Framework7Class {
       const { $el, $wrapperEl } = calendar;
 
       function handleTouchStart(e) {
-        if (isMoved || isTouched) return;
+        if (isMoved || isTouched || !e.isTrusted) return;
         isTouched = true;
         touchStartX = e.type === 'touchstart' ? e.targetTouches[0].pageX : e.pageX;
         touchCurrentX = touchStartX;
@@ -181,7 +181,7 @@ class Calendar extends Framework7Class {
         currentTranslate = calendar.monthsTranslate;
       }
       function handleTouchMove(e) {
-        if (!isTouched) return;
+        if (!isTouched || !e.isTrusted) return;
         const { isHorizontal: isH } = calendar;
 
         touchCurrentX = e.type === 'touchmove' ? e.targetTouches[0].pageX : e.pageX;
@@ -219,8 +219,8 @@ class Calendar extends Framework7Class {
           `translate3d(${isH ? currentTranslate : 0}%, ${isH ? 0 : currentTranslate}%, 0)`,
         );
       }
-      function handleTouchEnd() {
-        if (!isTouched || !isMoved) {
+      function handleTouchEnd(e) {
+        if (!isTouched || !isMoved || !e.isTrusted) {
           isTouched = false;
           isMoved = false;
           return;

diff --git a/src/core/components/card/card.js b/src/core/components/card/card.js
@@ -280,7 +280,7 @@ const CardExpandable = {
     let isH;
     let $cardScrollableEl;
     function onTouchStart(e) {
-      if (!$(e.target).closest($cardEl).length) return;
+      if (!$(e.target).closest($cardEl).length || !e.isTrusted) return;
       if (!$cardEl.hasClass('card-opened')) return;
       $cardScrollableEl = $cardEl.find(cardParams.scrollableEl);
 
@@ -301,7 +301,7 @@ const CardExpandable = {
       isH = false;
     }
     function onTouchMove(e) {
-      if (!isTouched) return;
+      if (!isTouched || !e.isTrusted) return;
       touchEndX = e.targetTouches[0].pageX;
       touchEndY = e.targetTouches[0].pageY;
       if (typeof isScrolling === 'undefined') {
@@ -351,8 +351,8 @@ const CardExpandable = {
         );
       }
     }
-    function onTouchEnd() {
-      if (!isTouched || !isMoved) return;
+    function onTouchEnd(e) {
+      if (!isTouched || !isMoved || !e.isTrusted) return;
       isTouched = false;
       isMoved = false;
       if (device.ios) {

diff --git a/src/core/components/popup/popup-class.js b/src/core/components/popup/popup-class.js
@@ -137,7 +137,7 @@ class Popup extends Modal {
     let $pushEl;
 
     function handleTouchStart(e) {
-      if (isTouched || !allowSwipeToClose || !popup.params.swipeToClose) return;
+      if (isTouched || !allowSwipeToClose || !popup.params.swipeToClose || !e.isTrusted) return;
       if (
         popup.params.swipeHandler &&
         $(e.target).closest(popup.params.swipeHandler).length === 0
@@ -157,7 +157,7 @@ class Popup extends Modal {
       }
     }
     function handleTouchMove(e) {
-      if (!isTouched) return;
+      if (!isTouched || !e.isTrusted) return;
       currentTouch = {
         x: e.type === 'touchmove' ? e.targetTouches[0].pageX : e.pageX,
         y: e.type === 'touchmove' ? e.targetTouches[0].pageY : e.pageY,
@@ -256,7 +256,8 @@ class Popup extends Modal {
       }
       $el.transition(0).transform(`translate3d(0,${-touchesDiff}px,0)`);
     }
-    function handleTouchEnd() {
+    function handleTouchEnd(e) {
+      if (!e.isTrusted) return;
       isTouched = false;
       if (!isMoved) {
         return;

diff --git a/src/core/components/pull-to-refresh/pull-to-refresh-class.js b/src/core/components/pull-to-refresh/pull-to-refresh-class.js
@@ -122,6 +122,7 @@ class PullToRefresh extends Framework7Class {
     }
 
     function handleTouchStart(e) {
+      if (!e.isTrusted) return;
       if (isTouched) {
         if (device.os === 'android') {
           if ('targetTouches' in e && e.targetTouches.length > 1) return;
@@ -147,7 +148,7 @@ class PullToRefresh extends Framework7Class {
     }
 
     function handleTouchMove(e) {
-      if (!isTouched) return;
+      if (!isTouched || !e.isTrusted) return;
       let pageX;
       let pageY;
       let touch;
@@ -327,6 +328,8 @@ class PullToRefresh extends Framework7Class {
       }
     }
     function handleTouchEnd(e) {
+      if (!e.isTrusted) return;
+
       if (e.type === 'touchend' && e.changedTouches && e.changedTouches.length > 0 && touchId) {
         if (e.changedTouches[0].identifier !== touchId) {
           isTouched = false;

diff --git a/src/core/components/sheet/sheet-class.js b/src/core/components/sheet/sheet-class.js
@@ -170,7 +170,8 @@ class Sheet extends Modal {
     let sheetPageContentOffsetHeight;
 
     function handleTouchStart(e) {
-      if (isTouched || !(sheet.params.swipeToClose || sheet.params.swipeToStep)) return;
+      if (isTouched || !(sheet.params.swipeToClose || sheet.params.swipeToStep) || !e.isTrusted)
+        return;
       if (
         sheet.params.swipeHandler &&
         $(e.target).closest(sheet.params.swipeHandler).length === 0
@@ -191,7 +192,7 @@ class Sheet extends Modal {
       }
     }
     function handleTouchMove(e) {
-      if (!isTouched) return;
+      if (!isTouched || !e.isTrusted) return;
       currentTouch = {
         x: e.type === 'touchmove' ? e.targetTouches[0].pageX : e.pageX,
         y: e.type === 'touchmove' ? e.targetTouches[0].pageY : e.pageY,

diff --git a/src/core/modules/router/swipe-back.js b/src/core/modules/router/swipe-back.js
@@ -344,6 +344,7 @@ function SwipeBack(r) {
   }
 
   function handleTouchStart(e) {
+    if (!e.isTrusted) return;
     const swipeBackEnabled = params[`${app.theme}SwipeBack`];
     if (
       !allowViewTouchMove ||
@@ -369,6 +370,7 @@ function SwipeBack(r) {
     dynamicNavbar = router.dynamicNavbar;
   }
   function handleTouchMove(e) {
+    if (!e.isTrusted) return;
     if (!isTouched) return;
     const pageX = e.type === 'touchmove' ? e.targetTouches[0].pageX : e.pageX;
     const pageY = e.type === 'touchmove' ? e.targetTouches[0].pageY : e.pageY;
@@ -505,7 +507,8 @@ function SwipeBack(r) {
 
     setAnimatableNavElements({ progress: percentage });
   }
-  function handleTouchEnd() {
+  function handleTouchEnd(e) {
+    if (!e.isTrusted) return;
     app.preventSwipePanelBySwipeBack = false;
     if (!isTouched || !isMoved) {
       isTouched = false;

diff --git a/src/core/modules/touch/touch.js b/src/core/modules/touch/touch.js
@@ -202,6 +202,7 @@ function initTouch() {
   let touchmoveActivableEl = null;
 
   function handleTouchStart(e) {
+    if (!e.isTrusted) return true;
     isMoved = false;
     tapHoldFired = false;
     preventClick = false;
@@ -249,6 +250,7 @@ function initTouch() {
     return true;
   }
   function handleTouchMove(e) {
+    if (!e.isTrusted) return;
     let touch;
     let distance;
     let shouldRemoveActive = true;
@@ -329,6 +331,7 @@ function initTouch() {
     }
   }
   function handleTouchEnd(e) {
+    if (!e.isTrusted) return true;
     isScrolling = undefined;
     isSegmentedStrong = false;
     segmentedStrongEl = null;