| Index: third_party/WebKit/Source/core/dom/Element.cpp
|
| diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
|
| index 316ab46c290824bdda94c157bfd1b715590322bb..e1f930bdc0bbd25d12acc47fb7bd4eea8473efbc 100644
|
| --- a/third_party/WebKit/Source/core/dom/Element.cpp
|
| +++ b/third_party/WebKit/Source/core/dom/Element.cpp
|
| @@ -2517,6 +2517,8 @@ void Element::setInnerHTML(const String& html, ExceptionState& exceptionState)
|
| container = toHTMLTemplateElement(this)->content();
|
| replaceChildrenWithFragment(container, fragment.release(), exceptionState);
|
| }
|
| +
|
| + taintElementIfFromIsolatedWorld();
|
| }
|
|
|
| void Element::setOuterHTML(const String& html, ExceptionState& exceptionState)
|
| @@ -2546,6 +2548,11 @@ void Element::setOuterHTML(const String& html, ExceptionState& exceptionState)
|
|
|
| if (!exceptionState.hadException() && prev && prev->isTextNode())
|
| mergeWithNextTextNode(toText(prev.get()), exceptionState);
|
| +
|
| + if (node && node->isElementNode())
|
| + toElement(node)->taintElementIfFromIsolatedWorld();
|
| + else
|
| + parent->taintElementIfFromIsolatedWorld();
|
| }
|
|
|
| Node* Element::insertAdjacent(const String& where, Node* newChild, ExceptionState& exceptionState)
|
| @@ -3616,6 +3623,16 @@ void Element::logUpdateAttributeIfIsolatedWorldAndInDocument(const char element[
|
| activityLogger->logEvent("blinkSetAttribute", argv.size(), argv.data());
|
| }
|
|
|
| +void Element::taintElementIfFromIsolatedWorld()
|
| +{
|
| + ASSERT(v8::Isolate::GetCurrent()->InContext());
|
| + DOMWrapperWorld& currentWorld = DOMWrapperWorld::current(v8::Isolate::GetCurrent());
|
| + if (currentWorld.isOfIsolatedWorldOrigin()) {
|
| + TrackExceptionState exceptionState;
|
| + this->setAttribute("extension-attribution", WebString(String::number(currentWorld.originWorldId())), exceptionState);
|
| + }
|
| +}
|
| +
|
| DEFINE_TRACE(Element)
|
| {
|
| #if ENABLE(OILPAN)
|
|
|