[document pip] Allow resizeTo()/resizeBy() via user gesture

Currently, we don't allow picture-in-picture windows to use the resizeTo() and resizeBy() APIs to prevent abuse. This CL adds a user gesture requirement to those APIs for document picture-in-picture windows to allow them to use those APIs while limiting the potential for abuse. Specification: WICG/document-picture-in-picture#104 Bug: 1354325 Change-Id: I6eabb2e9b8923ec1fc395cb44e3cc00ad674f5da Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4980802 Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Fr <beaufort.francois@gmail.com> Reviewed-by: Frank Liberato <liberato@chromium.org> Reviewed-by: Scott Violet <sky@chromium.org> Commit-Queue: Tommy Steimel <steimel@chromium.org> Cr-Commit-Position: refs/heads/main@{#1230725}
web-platform-tests · Nov 29, 2023 · 1e5ebf6 · 1e5ebf6
1 parent 014c3ae
commit 1e5ebf6
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/document-picture-in-picture/resize-requires-user-gesture.https.html b/document-picture-in-picture/resize-requires-user-gesture.https.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>Test that calling resizeTo() or resizeBy() on a document
+  picture-in-picture window requires user gesture</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body>
+<script>
+promise_test(async (t) => {
+  await test_driver.bless('request PiP window from top window');
+  const pipWindow = await documentPictureInPicture.requestWindow();
+
+  await assert_throws_dom('NotAllowedError', pipWindow.DOMException, () => {
+    pipWindow.resizeBy(10, 10);
+  }, 'resizeBy() requires a user gesture for document picture-in-picture');
+  await assert_throws_dom('NotAllowedError', pipWindow.DOMException, () => {
+    pipWindow.resizeTo(400, 400);
+  }, 'resizeTo() requires a user gesture for document picture-in-picture');
+});
+</script>
+</body>