Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1630)

Issue 1670203002: Block HTML Imports from loading when inserted via innerHTML. (Closed)

Created:
4 years, 10 months ago by Mike West
Modified:
3 years, 5 months ago
CC:
blink-reviews, blink-reviews-html_chromium.org, chromium-reviews, dglazkov+blink, gavinp+prerender_chromium.org, kinuko+watch, tfarina, webcomponents-bugzilla_chromium.org, Yoav Weiss
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Block HTML Imports from loading when inserted via innerHTML. This matches the 'already started' behavior of '<script>' (which also does not execute in 'innerHTML'. BUG=416036

Patch Set 1 #

Total comments: 7
Unified diffs Side-by-side diffs Delta from patch set Stats (+53 lines, -5 lines) Patch
A third_party/WebKit/LayoutTests/http/tests/htmlimports/import-innerHTML-blocked.html View 1 chunk +20 lines, -0 lines 2 comments Download
M third_party/WebKit/Source/core/html/HTMLLinkElement.h View 4 chunks +4 lines, -2 lines 3 comments Download
M third_party/WebKit/Source/core/html/HTMLLinkElement.cpp View 1 chunk +4 lines, -3 lines 0 comments Download
M third_party/WebKit/Source/core/html/imports/LinkImport.cpp View 1 chunk +2 lines, -0 lines 0 comments Download
M third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.h View 1 chunk +1 line, -0 lines 0 comments Download
M third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp View 3 chunks +22 lines, -0 lines 2 comments Download

Messages

Total messages: 5 (1 generated)
Mike West
Hello, kouhei@! Would you mind reviewing this small change to the parser? I talked with ...
4 years, 10 months ago (2016-02-05 15:15:42 UTC) #2
dglazkov
https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/core/html/HTMLLinkElement.h File third_party/WebKit/Source/core/html/HTMLLinkElement.h (right): https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/core/html/HTMLLinkElement.h#newcode136 third_party/WebKit/Source/core/html/HTMLLinkElement.h:136: static PassRefPtrWillBeRawPtr<HTMLLinkElement> create(Document&, bool createdByParser, bool alreadyStarted = false); ...
4 years, 10 months ago (2016-02-05 18:25:54 UTC) #3
kouhei (in TOK)
QQ: Do we only want to disable "imports" from innerHTML? <link> tag is used for ...
4 years, 10 months ago (2016-02-08 01:00:31 UTC) #4
kouhei (in TOK)
4 years, 10 months ago (2016-02-08 01:30:24 UTC) #5
https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/html/HTMLLinkElement.h (right):

https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/html/HTMLLinkElement.h:136: static
PassRefPtrWillBeRawPtr<HTMLLinkElement> create(Document&, bool createdByParser,
bool alreadyStarted = false);
On 2016/02/05 18:25:53, dglazkov wrote:
> Can we use an enum bere?
> 
> https://www.chromium.org/blink/coding-style#TOC-Names
> 
> "Prefer enums to bools on function parameters if callers are likely to be
> passing constants, since named constants are easier to read at the call site.
An
> exception to this rule is a setter function, where the name of the function
> already makes clear what the boolean is."

+1
I prefer extending "bool createdByParser" to enum, and appending
CreatedByFragmentParser state there.

https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp
(right):

https://codereview.chromium.org/1670203002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp:677: const
bool parserInserted = m_parserContentPolicy !=
AllowScriptingContentAndDoNotMarkAlreadyStarted;
I'm not sure if we should respect
"AllowScriptingContentAndDoNotMarkAlreadyStarted" here.
However, after some archeology, the only code using the flag is added on the CL:
https://chromium.googlesource.com/chromium/src/+/ea2645777533e3efba4f2ab16f49...
And I don't see a good reason why the code needs to use the flag.
Let me try a CL that removes the flag entirely.

Powered by Google App Engine
This is Rietveld 408576698