[w3c/browser-payment-api] Unstrusted events can update PaymentRequest (#546)

Unless I've missed something, it seems one can co-opt and untrusted event to do the work of a trusted event*:

```JS
const request = new PaymentRequest(defaultMethods, defaultDetails);
const untrustedEvent = new PaymentRequestUpdateEvent("test"); 
request.dispatchEvent(ev); // set .target
request.show();
request.onshippingaddresschange = () => {
  const update = {
    total: {
      label: "Untrusted",
      amount: {
        currency: "USD",
        value: "1111.00",
      },
    },
  };
  untrustedEvent.updateWith(Promise.resolve(update));
};
```
We might just need to say in `.updateWith()` that if the event is untrusted, throw a `SecurityError` or `NotAllowedError`.

* Chrome ignores this.  

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/546