mind isTrusted for click events (see https://palant.de/2017/11/11/on-web-extensions-shortcomings-and-their-impact-on-add-on-security)

gorhill · gorhill · commit 034e46b0551a · 2017-11-12T07:44:28.000-05:00
diff --git a/src/js/scriptlets/element-picker.js b/src/js/scriptlets/element-picker.js
@@ -1092,6 +1092,7 @@ var filterChoiceFromEvent = function(ev) {
 /******************************************************************************/
 
 var onDialogClicked = function(ev) {
+    if ( ev.isTrusted === false ) { return; }
 
     // If the dialog is hidden, clicking on it force it to become visible.
     if ( dialog.classList.contains('hide') ) {
@@ -1310,7 +1311,8 @@ var onSvgTouchStartStop = (function() {
                 type: 'touch',
                 target: ev.target,
                 clientX: ev.changedTouches[0].pageX,
-                clientY: ev.changedTouches[0].pageY
+                clientY: ev.changedTouches[0].pageY,
+                isTrusted: ev.isTrusted
             });
             ev.preventDefault();
             return;
@@ -1346,6 +1348,8 @@ var onSvgTouchStartStop = (function() {
 /******************************************************************************/
 
 var onSvgClicked = function(ev) {
+    if ( ev.isTrusted === false ) { return; }
+
     // If zap mode, highlight element under mouse, this makes the zapper usable
     // on touch screens.
     if ( pickerBody.classList.contains('zap') ) {
