[widget] Require user interaction when picking files or folders v2

Now with extra sauce to make it work cross-platform and cross-versions and
for HTML input elements only.

dom/html/HTMLInputElement.cpp

@@ -866,7 +866,7 @@ HTMLInputElement::InitFilePicker(FilePickerType aType)
     mode = static_cast<int16_t>(nsIFilePicker::modeOpen);
   }
 
-  nsresult rv = filePicker->Init(win, title, mode);
+  nsresult rv = filePicker->Init(win, title, mode, /*aRequireInteraction = */ true);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!okButtonLabel.IsEmpty()) {

dom/ipc/FilePickerParent.cpp

@@ -248,7 +248,8 @@ FilePickerParent::CreateFilePicker()
     return false;
   }
 
-  return NS_SUCCEEDED(mFilePicker->Init(window, mTitle, mMode));
+  return NS_SUCCEEDED(mFilePicker->Init(window, mTitle, mMode,
+                                        element->IsNodeOfType(nsINode::eHTML_FORM_CONTROL)));
 }
 
 bool

widget/nsBaseFilePicker.cpp

@@ -166,7 +166,8 @@ nsBaseFilePicker::~nsBaseFilePicker()
 
 NS_IMETHODIMP nsBaseFilePicker::Init(mozIDOMWindowProxy* aParent,
                                      const nsAString& aTitle,
-                                     int16_t aMode)
+                                     int16_t aMode,
+                                     bool aRequireInteraction)
 {
   NS_PRECONDITION(aParent, "Null parent passed to filepicker, no file "
                   "picker for you!");

widget/nsBaseFilePicker.h

@@ -25,7 +25,8 @@ public:
 
   NS_IMETHOD Init(mozIDOMWindowProxy* aParent,
                   const nsAString& aTitle,
-                  int16_t aMode);
+                  int16_t aMode,
+                  bool aRequireInteraction = false);
 
   NS_IMETHOD Open(nsIFilePickerShownCallback *aCallback);
   NS_IMETHOD AppendFilters(int32_t filterMask);

widget/nsFilePickerProxy.cpp

@@ -27,7 +27,7 @@ nsFilePickerProxy::~nsFilePickerProxy()
 
 NS_IMETHODIMP
 nsFilePickerProxy::Init(mozIDOMWindowProxy* aParent, const nsAString& aTitle,
-                        int16_t aMode)
+                        int16_t aMode, bool aRequireInteraction)
 {
   TabChild* tabChild = TabChild::GetFrom(aParent);
   if (!tabChild) {

widget/nsFilePickerProxy.h

@@ -34,7 +34,7 @@ public:
     NS_DECL_ISUPPORTS
 
     // nsIFilePicker (less what's in nsBaseFilePicker)
-    NS_IMETHOD Init(mozIDOMWindowProxy* aParent, const nsAString& aTitle, int16_t aMode) override;
+    NS_IMETHOD Init(mozIDOMWindowProxy* aParent, const nsAString& aTitle, int16_t aMode, bool aRequireInteraction = false) override;
     NS_IMETHOD AppendFilter(const nsAString& aTitle, const nsAString& aFilter) override;
     NS_IMETHOD GetDefaultString(nsAString& aDefaultString) override;
     NS_IMETHOD SetDefaultString(const nsAString& aDefaultString) override;

widget/nsIFilePicker.idl

@@ -66,9 +66,12 @@ interface nsIFilePicker : nsISupports
   *                      on this parent. parent must be non-null.
   * @param      title    The title for the file widget
   * @param      mode     load, save, or get folder
+  * @param      requireinteraction (optional)
+  *                      require interaction before confirmation is possible
   *
   */
-  void init(in mozIDOMWindowProxy parent, in AString title, in short mode);
+  void init(in mozIDOMWindowProxy parent, in AString title, in short mode,
+            [optional] in boolean requireinteraction);
 
  /**
   * Append to the  filter list with things from the predefined list

widget/windows/nsFilePicker.cpp

@@ -30,6 +30,7 @@
 
 using mozilla::IsVistaOrLater;
 using mozilla::IsWin8OrLater;
+using mozilla::IsWin10OrLater;
 using mozilla::MakeUnique;
 using mozilla::mscom::EnsureMTA;
 using mozilla::UniquePtr;
@@ -194,11 +195,13 @@ nsFilePicker::~nsFilePicker()
 
 NS_IMPL_ISUPPORTS(nsFilePicker, nsIFilePicker)
 
-NS_IMETHODIMP nsFilePicker::Init(mozIDOMWindowProxy *aParent, const nsAString& aTitle, int16_t aMode)
+NS_IMETHODIMP nsFilePicker::Init(mozIDOMWindowProxy *aParent, const nsAString& aTitle, int16_t aMode,
+                                 bool aRequireInteraction)
 {
   nsCOMPtr<nsPIDOMWindowOuter> window = do_QueryInterface(aParent);
   nsIDocShell* docShell = window ? window->GetDocShell() : nullptr;  
   mLoadContext = do_QueryInterface(docShell);
+  mRequireInteraction = aRequireInteraction;
   
   return nsBaseFilePicker::Init(aParent, aTitle, aMode);
 }
@@ -603,6 +606,13 @@ nsFilePicker::ShowFolderPicker(const nsString& aInitialDir, bool &aWasInitError)
 
   // options
   FILEOPENDIALOGOPTIONS fos = FOS_PICKFOLDERS;
+  // Require interaction if the folder picker is triggered by an element that
+  // is potentially unsafe to use the default value in.
+  // Win 10+ only, because this dialog flag is broken in earlier versions.
+  if (IsWin10OrLater() && mRequireInteraction) {
+    fos |= FOS_OKBUTTONNEEDSINTERACTION;
+  }
+
   dialog->SetOptions(fos);
  
   // initial strings
@@ -924,6 +934,13 @@ nsFilePicker::ShowFilePicker(const nsString& aInitialDir, bool &aWasInitError)
   fos |= FOS_SHAREAWARE | FOS_OVERWRITEPROMPT |
          FOS_FORCEFILESYSTEM;
   
+  // Require interaction if the file picker is triggered by an element that
+  // is potentially unsafe to use the default value in.
+  // Win 10+ only, because this dialog flag is broken in earlier versions.
+  if (IsWin10OrLater() && mRequireInteraction) {
+    fos |= FOS_OKBUTTONNEEDSINTERACTION;
+  }
+
   // Handle add to recent docs settings
   if (IsPrivacyModeEnabled() || !mAddToRecentDocs) {
     fos |= FOS_DONTADDTORECENT;

widget/windows/nsFilePicker.h

@@ -60,7 +60,8 @@ class nsFilePicker :
 public:
   nsFilePicker();
 
-  NS_IMETHOD Init(mozIDOMWindowProxy *aParent, const nsAString& aTitle, int16_t aMode);
+  NS_IMETHOD Init(mozIDOMWindowProxy *aParent, const nsAString& aTitle, int16_t aMode,
+                  bool aRequireInteraction = false);
 
   NS_DECL_ISUPPORTS
 
@@ -125,6 +126,7 @@ protected:
   nsString               mUnicodeFile;
   static char16_t      *mLastUsedUnicodeDirectory;
   HWND                   mDlgWnd;
+  bool                   mRequireInteraction;
 
   class ComDlgFilterSpec
   {