nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1830757 - Prevent node removal during iteration in conditional css sanitization. r=smaug

Browse source 
When the whole block is sanitized away, we remove the text node
altogether, triggering the assert. While it's not worrisome in this
case, the right thing to do is not mutating the DOM during iteration.

Differential Revision: https://phabricator.services.mozilla.com/D176917
This commit is contained in:
Emilio Cobos Álvarez 2023-05-02 14:52:23 +00:00
parent e22d1a4b5b
commit 6d68b86f7c
2 changed files with 10 additions and 3 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

9
dom/base/nsTreeSanitizer.cpp
View file

@ -1823,11 +1823,14 @@ bool nsTreeSanitizer::SanitizeInlineStyle(
}
void nsTreeSanitizer::RemoveConditionalCSSFromSubtree(nsINode* aRoot) {
AutoTArray<RefPtr<nsINode>, 10> nodesToSanitize;
for (nsINode* node : ShadowIncludingTreeIterator(*aRoot)) {
if (!node->IsHTMLElement(nsGkAtoms::style) &&
!node->IsSVGElement(nsGkAtoms::style)) {
continue;
if (node->IsHTMLElement(nsGkAtoms::style) ||
node->IsSVGElement(nsGkAtoms::style)) {
nodesToSanitize.AppendElement(node);
}
}
for (nsINode* node : nodesToSanitize) {
SanitizeInlineStyle(node->AsElement(),
StyleSanitizationKind::NoConditionalRules);
}

4
parser/xml/test/unit/test_sanitizer_style.js
View file

@ -71,6 +71,10 @@ const kConditionalCSSTestCases = [
data: `#foo { display: none } @media (min-width: 300px) { #bar { display: none } }`,
sanitized: `#foo { display: none }`,
},
{
data: `@media (min-width: 300px) { #bar { display: none } }`,
sanitized: ``,
},
];
function run_test() {