Merge 147281 "Cross-Origin copy&paste / drag&drop allowing XSS v..."

Source/WebCore/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1021 matching lines @@
 // Returns true is the given attribute is an event handler.
 // We consider an event handler any attribute that begins with "on".
 // It is a simple solution that has the advantage of not requiring any
 // code or configuration change if a new event handler is defined.
 
 static inline bool isEventHandlerAttribute(const Attribute& attribute)
 {
     return attribute.name().namespaceURI().isNull() && attribute.name().localName().startsWith("on");
 }
 
-bool Element::isJavaScriptURLAttribute(const Attribute& attribute)
+bool Element::isJavaScriptURLAttribute(const Attribute& attribute) const
 {
-    if (!isURLAttribute(attribute))
-        return false;
-    if (!protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value())))
-        return false;
-    return true;
+    return isURLAttribute(attribute) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
 }
 
-bool Element::isJavaScriptAttribute(const Attribute& attribute)
-{
-    if (isEventHandlerAttribute(attribute))
-        return true;
-    if (isJavaScriptURLAttribute(attribute))
-        return true;
-    return false;
-}
-
-void Element::stripJavaScriptAttributes(Vector<Attribute>& attributeVector)
+void Element::stripScriptingAttributes(Vector<Attribute>& attributeVector) const
 {
     size_t destination = 0;
     for (size_t source = 0; source < attributeVector.size(); ++source) {
-        if (isJavaScriptAttribute(attributeVector[source]))
+        if (isEventHandlerAttribute(attributeVector[source])
+            || isJavaScriptURLAttribute(attributeVector[source])
+            || isHTMLContentAttribute(attributeVector[source]))
             continue;
 
         if (source != destination)
             attributeVector[destination] = attributeVector[source];
 
         ++destination;
     }
     attributeVector.shrink(destination);
 }
 
@@ skipping 2050 matching lines @@
     return 0;
 }
 
 Attribute* UniqueElementData::attributeItem(unsigned index)
 {
     ASSERT_WITH_SECURITY_IMPLICATION(index < length());
     return &m_attributeVector.at(index);
 }
 
 } // namespace WebCore