What is the scope of pointerCapture?

The setPointerCapture() and releasePointerCapture() are rather interesting and I can think of quite a few edge cases.  But I think many of them come down to a question of capture scope.  What exactly is the scope of the capture?

- Is it the pointer events that would ordinarily go to a child of element.documentParent? (events are not delivered if the pointer leaves the boundaries of the element's document)
- Is it the pointer events that would ordinarily go to a child of the top-most document containing the element (something like element.documentParent.window.top.document).  (events are delivered even if the pointer leaves the boundaries of the element's parent document, events stop being delivered if they leave the boundaries of the top-most containing document).
- Is it the pointer events that would ordinarily go to a child of the user agent (The pointer event is delivered even if it leaves the topmost window and travels around the UI of the user agent itself, events stop being seen if the pointer leaves the boundaries of the user agent)
- Is it all pointer events for this pointer reported by the hardware (The pointer event is delivered even if the pointer leaves the boundaries of the user agent, e.g. the pointer can wander outside the browser window to anywhere on the device and the events are still delivered to the target element).
- Something else entirely?

As an author, I have a preference for the last one.  It seems to match what happens with mouse events (after my web page receives a mousedown event, it continues receiving mousemove and mouseup events even if the mouse is outside the browser window).

If the capture scope extends beyond element.documentParent, then what if code in a child iframe uses this API to maliciously capture all active pointers (including the mouse which is considered active even when not pressed)?  Can such malicious code steal all pointer events from the rest of the user agent, possibly even the entire user's desktop?


Does the element still receive the pointer events if it is removed from the DOM tree (via removeChild)?

Thanks,
Brandon

Received on Friday, 28 September 2012 14:28:00 UTC