Merge 147281 "Cross-Origin copy&paste / drag&drop allowing XSS v..."

Source/WebCore/dom/Element.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 362 matching lines @@
     // For exposing to DOM only.
     NamedNodeMap* attributes() const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(const QualifiedName&, const AtomicString&);
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) { }
 
     // Only called by the parser immediately after element construction.
     void parserSetAttributes(const Vector<Attribute>&);
 
-    void stripJavaScriptAttributes(Vector<Attribute>&);
+    // Remove attributes that might introduce scripting from the vector leaving the element unchanged.
+    void stripScriptingAttributes(Vector<Attribute>&) const;
 
     const ElementData* elementData() const { return m_elementData.get(); }
     UniqueElementData* ensureUniqueElementData();
 
     void synchronizeAllAttributes() const;
 
     // Clones attributes only.
     void cloneAttributesFromElement(const Element&);
 
     // Clones all attribute-derived data, including subclass specifics (through copyNonAttributeProperties.)
@@ skipping 53 matching lines @@
 
     void setIsInCanvasSubtree(bool);
     bool isInCanvasSubtree() const;
 
     AtomicString computeInheritedLanguage() const;
     Locale& locale() const;
 
     virtual void accessKeyAction(bool /*sendToAnyEvent*/) { }
 
     virtual bool isURLAttribute(const Attribute&) const { return false; }
+    virtual bool isHTMLContentAttribute(const Attribute&) const { return false; }
 
     KURL getURLAttribute(const QualifiedName&) const;
     KURL getNonEmptyURLAttribute(const QualifiedName&) const;
 
     virtual const AtomicString& imageSourceURL() const;
     virtual String target() const { return String(); }
 
     virtual void focus(bool restorePreviousSelection = true, FocusDirection = FocusDirectionNone);
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void blur();
@@ skipping 252 matching lines @@
     bool shouldInvalidateDistributionWhenAttributeChanged(ElementShadow*, const QualifiedName&, const AtomicString&);
 
     ElementRareData* elementRareData() const;
     ElementRareData* ensureElementRareData();
 
     void detachAllAttrNodesFromElement();
     void detachAttrNodeFromElementWithValue(Attr*, const AtomicString& value);
 
     void createRendererIfNeeded();
 
-    bool isJavaScriptAttribute(const Attribute&);
-    bool isJavaScriptURLAttribute(const Attribute&);
+    bool isJavaScriptURLAttribute(const Attribute&) const;
 
     RefPtr<ElementData> m_elementData;
 };
     
 inline Element* toElement(Node* node)
 {
     ASSERT_WITH_SECURITY_IMPLICATION(!node || node->isElementNode());
     return static_cast<Element*>(node);
 }
 
@@ skipping 242 matching lines @@
 {
     ASSERT_WITH_SECURITY_IMPLICATION(index < length());
     if (m_isUnique)
         return &static_cast<const UniqueElementData*>(this)->m_attributeVector.at(index);
     return &static_cast<const ShareableElementData*>(this)->m_attributeArray[index];
 }
 
 } // namespace
 
 #endif