wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-31 03:51:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1378079 - Part 2: Introduce throw-on-dynamic-markup-insertion counter.

Browse source 
Per spec, document objects have a throw-on-dynamic-markup-insertion counter, which is used in conjunction with the create an element for the token algorithm to prevent custom element constructors from being able to use document.open(), document.close(), and document.write() when they are invoked by the parser.

Tag UXP Issue #1344
This commit is contained in:
Gaming4JC 2020-01-18 20:26:28 -05:00 • committed by Roy Tam
commit a3b5d98af7
3 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dom/html/nsHTMLDocument.cpp
View file

@ -1401,6 +1401,11 @@ nsHTMLDocument::Open(JSContext* cx,
return nullptr;
}
if (ShouldThrowOnDynamicMarkupInsertion()) {
aError.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
return nullptr;
}
// Set up the content type for insertion
nsAutoCString contentType;
contentType.AssignLiteral("text/html");
@ -1608,6 +1613,11 @@ nsHTMLDocument::Close(ErrorResult& rv)
return;
}
if (ShouldThrowOnDynamicMarkupInsertion()) {
rv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
return;
}
if (!mParser || !mParser->IsScriptCreated()) {
return;
}
@ -1683,6 +1693,10 @@ nsHTMLDocument::WriteCommon(JSContext *cx,
return NS_ERROR_DOM_INVALID_STATE_ERR;
}
if (ShouldThrowOnDynamicMarkupInsertion()) {
return NS_ERROR_DOM_INVALID_STATE_ERR;
}
if (mParserAborted) {
// Hixie says aborting the parser doesn't undefine the insertion point.
// However, since we null out mParser in that case, we track the