corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1835437 - Be consistent about value sanitization in HTMLInputElement::SetDirectionFromValue. r=smaug

Browse Source 
aKnownValue is unsanitized, but GetValue is sanitized. Make sure they
match.

Differential Revision: https://phabricator.services.mozilla.com/D179790
This commit is contained in:
Emilio Cobos Álvarez
2023-06-04 08:54:25 +00:00
parent 65f27c246f
commit 9ba33a8798
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
dom/html/HTMLInputElement.cpp
View File

@@ -5698,14 +5698,23 @@ nsresult HTMLInputElement::SetDefaultValueAsValue() {
void HTMLInputElement::SetDirectionFromValue(bool aNotify,
const nsAString* aKnownValue) {
if (IsSingleLineTextControl(true)) {
nsAutoString value;
if (!aKnownValue) {
GetValue(value, CallerType::System);
aKnownValue = &value;
}
SetDirectionalityFromValue(this, *aKnownValue, aNotify);
// FIXME(emilio): https://html.spec.whatwg.org/#the-directionality says this
// applies to Text, Search, Telephone, URL, or Email state, but the check
// below doesn't filter out week/month/number.
if (!IsSingleLineTextControl(true)) {
return;
}
nsAutoString value;
if (!aKnownValue) {
// It's unclear if per spec we should use the sanitized or unsanitized
// value to set the directionality, but aKnownValue is unsanitized, so be
// consistent. Using what the user is seeing to determine directionality
// instead of the sanitized (empty if invalid) value probably makes more
// sense.
GetValueInternal(value, CallerType::System);
aKnownValue = &value;
}
SetDirectionalityFromValue(this, *aKnownValue, aNotify);
}
NS_IMETHODIMP