corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1953720 - In SetHTML create the inert document by inherting from the current document. r=emilio

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D241363
This commit is contained in:
Tom Schuster
2025-03-14 12:22:56 +00:00
parent 7507c4ce14
commit f269ef0615
3 changed files with 2 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dom/base/Element.cpp
View File

@@ -5378,7 +5378,7 @@ void Element::SetHTML(const nsAString& aInnerHTML,
ElementCreationOptionsOrString options; ElementCreationOptionsOrString options;
RefPtr<DocumentFragment> fragment; RefPtr<DocumentFragment> fragment;
if (doc->IsHTMLDocument()) { if (doc->IsHTMLDocument()) {
inertDoc = nsContentUtils::CreateInertHTMLDocument(nullptr); inertDoc = nsContentUtils::CreateInertHTMLDocument(doc);
if (!inertDoc) { if (!inertDoc) {
aError = NS_ERROR_FAILURE; aError = NS_ERROR_FAILURE;
return; return;
@@ -5392,7 +5392,7 @@ void Element::SetHTML(const nsAString& aInnerHTML,
} else { } else {
MOZ_ASSERT(doc->IsXMLDocument()); MOZ_ASSERT(doc->IsXMLDocument());
inertDoc = nsContentUtils::CreateInertXMLDocument(nullptr); inertDoc = nsContentUtils::CreateInertXMLDocument(doc);
if (!inertDoc) { if (!inertDoc) {
aError = NS_ERROR_FAILURE; aError = NS_ERROR_FAILURE;
return; return;

3
dom/security/sanitizer/Sanitizer.cpp
View File

@@ -826,9 +826,6 @@ void Sanitizer::SanitizeChildren(nsINode* aNode, bool aSafe) {
if (auto* templateEl = HTMLTemplateElement::FromNode(child)) { if (auto* templateEl = HTMLTemplateElement::FromNode(child)) {
// Step 2.4.4.1. Then call sanitize core on child’s template contents with // Step 2.4.4.1. Then call sanitize core on child’s template contents with
// configuration and handleJavascriptNavigationUrls. // configuration and handleJavascriptNavigationUrls.
// TODO: The <template>'s content can't be accessed after sanitizing,
// because nsINode::WrapObject throws NS_ERROR_UNEXPECTED.
RefPtr<DocumentFragment> frag = templateEl->Content(); RefPtr<DocumentFragment> frag = templateEl->Content();
SanitizeChildren<IsDefaultConfig>(frag, aSafe); SanitizeChildren<IsDefaultConfig>(frag, aSafe);
} }

19
testing/web-platform/meta/sanitizer-api/sethtml-tree-construction.tentative.html.ini
View File

@@ -4,9 +4,6 @@
[Testcase #20, "<div>test<div>p</div>tt<p>div</p></div>", config: "{ "elements": ["p"\], "replaceWithChildrenElements": ["div"\] }".] [Testcase #20, "<div>test<div>p</div>tt<p>div</p></div>", config: "{ "elements": ["p"\], "replaceWithChildrenElements": ["div"\] }".]
expected: FAIL expected: FAIL
[Testcase #34, "<template><script>test</script><div>hello</div></template>", config: "{ "elements": ["template", "div"\] }".]
expected: FAIL
[Testcase #66, "<div>balabala<i>test</i></div><test>t</test><custom-element>custom-element</custom-element>", config: "{ "replaceWithChildrenElements": [123, "test", "i", "custom-element"\],\n "elements": ["div"\]}".] [Testcase #66, "<div>balabala<i>test</i></div><test>t</test><custom-element>custom-element</custom-element>", config: "{ "replaceWithChildrenElements": [123, "test", "i", "custom-element"\],\n "elements": ["div"\]}".]
expected: FAIL expected: FAIL
@@ -19,15 +16,6 @@
[Testcase #75, "<template><div>Hello</div></template>", config: "{ "elements": ["template"\], "replaceWithChildrenElements": ["div"\]}".] [Testcase #75, "<template><div>Hello</div></template>", config: "{ "elements": ["template"\], "replaceWithChildrenElements": ["div"\]}".]
expected: FAIL expected: FAIL
[Testcase #73, "<template><div>Hello</div></template>", config: "{ "elements": ["template"\]}".]
expected: FAIL
[Testcase #71, "<template><div>Hello</div></template>", config: "{}".]
expected: FAIL
[Testcase #74, "<template><div>Hello</div></template>", config: "{ "elements": ["div", "template"\]}".]
expected: FAIL
[Testcase #31, "<div id='div' title='div'>DIV</div>", config: "{\n "elements": [{ "name": "div", "removeAttributes": ["id", "title"\] }\],\n "attributes": ["id", "title"\]\n}".] [Testcase #31, "<div id='div' title='div'>DIV</div>", config: "{\n "elements": [{ "name": "div", "removeAttributes": ["id", "title"\] }\],\n "attributes": ["id", "title"\]\n}".]
expected: expected:
if (os == "android") and not debug: [FAIL, PASS] if (os == "android") and not debug: [FAIL, PASS]
@@ -39,9 +27,6 @@
[Testcase #28, "<div id='div' title='div'>DIV</div>", config: "{ "elements": [{ "name": "div", "attributes": ["id"\], "removeAttributes": ["id"\] }\]}".] [Testcase #28, "<div id='div' title='div'>DIV</div>", config: "{ "elements": [{ "name": "div", "attributes": ["id"\], "removeAttributes": ["id"\] }\]}".]
expected: FAIL expected: FAIL
[Testcase #74, "<template><div>Hello</div></template>", config: "{ "elements": ["div", "template"\]}".]
expected: FAIL
[Testcase #61, "<DIV>balabala<DL>test</DL></DIV>", config: "{ "removeElements": ["i", "dl"\] }".] [Testcase #61, "<DIV>balabala<DL>test</DL></DIV>", config: "{ "removeElements": ["i", "dl"\] }".]
expected: expected:
if (os == "android") and not debug: [PASS, FAIL] if (os == "android") and not debug: [PASS, FAIL]
@@ -126,10 +111,6 @@
expected: expected:
if (os == "android") and not debug: [PASS, FAIL] if (os == "android") and not debug: [PASS, FAIL]
[Testcase #72, "<template><div>Hello</div></template>", config: "{ "elements": ["div"\]}".]
expected:
if (os == "android") and not debug: [PASS, FAIL]
[Testcase #50, "<p>Some text</p></body><!-- 1 --></html><!-- 2 --><p>Some more text</p>", config: "undefined".] [Testcase #50, "<p>Some text</p></body><!-- 1 --></html><!-- 2 --><p>Some more text</p>", config: "undefined".]
expected: expected:
if (os == "android") and not debug: [PASS, FAIL] if (os == "android") and not debug: [PASS, FAIL]